4.

1 Network Fundamentals

Network Classifications

By Size/Range:

• PAN (Personal Area Network):

o Short-range communications (typically less than a few meters)
o Examples: Wireless headset to smartphone, wireless mouse to PC
• LAN (Local Area Network):
o Single building or building complex
o Examples: University campus, manufacturing plant
• MAN (Metropolitan Area Network):
o Intermediate size, spanning local community
• WAN (Wide Area Network):
o Greater distances—neighbouring cities or opposite sides of world

By Design Ownership:

• Open Network:
o Based on public domain designs
o Freely circulated, no license fees
o Example: Internet (uses TCP/IP protocol suite)
• Closed/Proprietary Network:
o Owned and controlled by specific entity
o Restricted by license fees and contracts
o Example: Novell Inc. systems

By Topology:

a. Bus b. Star

Computer Computer Computer Computer

Computer Computer
Computer

Computer Computer Computer Computer

Image Description: Shows two network configurations:

• Part a (Bus Topology): Multiple computers connected to a single horizontal line (the
bus), with computers branching off from both top and bottom
• Part b (Star Topology): One central computer in the middle with other computers
arranged in a circle around it, all connected to the center point

Bus Topology:

• All machines connected to common communication line (bus)

 • Popularized in 1990s with Ethernet standards
• Ethernet remains one of most popular networking systems today
• Each message broadcast to all machines
• Each machine monitors all messages, keeps only those addressed to itself

Star Topology:

• One machine serves as central focal point

• All others connected to it
• Roots in 1970s from large central computer paradigm
• Popular in wireless networks
• Central machine called Access Point (AP)
• AP coordinates all communication

Important Note: Physical arrangement doesn't always match logical topology. A hub can
make network look like star but operate like bus.

Protocols

Definition: Rules by which network activities are conducted

• Enable vendor compatibility through standards

• Essential for networking technology development

CSMA/CD (Carrier Sense, Multiple Access with Collision Detection):

Used in Ethernet bus networks

Computer Computer Computer

Computer Computer

Image Description: Shows 5 computers connected to a horizontal bus line, demonstrating

how all machines connect to the common communication channel.

Process:

1. Each message broadcast to all machines on bus

2. Each machine monitors all messages
3. Keeps only messages addressed to itself
4. To transmit: waits until bus is silent
5. Begins transmitting while continuing to monitor
 6. If collision detected, both machines pause
7. Wait random time period, then retry

Human Analogy: Like people in conversation—if two start talking at once, both stop and try
again later

CSMA/CA (Carrier Sense, Multiple Access with Collision Avoidance):

Used in wireless star networks (WiFi - IEEE 802.11)

Range of B

Range of C

B Access point

Building
C

None of the end systems

can hear each other although
each can communicate
Range of A with the AP.

Image Description: Shows an Access Point (AP) in the center with three end systems (A, B,
C) positioned around it. Circular ranges show coverage areas for each system. A building
blocks communication between systems. Demonstrates that A, B, and C can each
communicate with AP but cannot hear each other.

Why Different from CSMA/CD?

• Machine may not detect collision (own signal drowns out others)
• Hidden Terminal Problem: Signals blocked by objects/distance even though all can
communicate with central AP

Collision Avoidance Approach:

• Machine waits short period before transmitting when channel silent

• Gives priority to machines already waiting
 • May use request/acknowledgment with AP
• Designed to avoid collisions (may not eliminate completely)
• Collisions still require message retransmission

Combining Networks

Devices for Same-Type Networks:

Repeater Switch
or
Bridge

a. A repeater or bridge connecting b. A switch connecting multiple buses

two buses
Image Description:

• Part a: Shows two bus networks connected by a Repeater or Bridge device in the
middle
• Part b: Shows a central Switch with multiple bus networks extending from it like
spokes on a wheel

1. Repeater:

• Simplest device
• Passes signals back and forth (with amplification)
• Doesn't consider signal meaning
• Just relays what it receives

2. Bridge:

• More complex than repeater

• Examines destination addresses
• Forwards messages only when destined for other side
• More efficient than repeater
• Two machines on same side can communicate without interfering with other side

3. Switch:

• Bridge with multiple connections

• Connects several buses (spoke pattern)
 • Considers destination addresses
• Forwards only to appropriate spoke
• Minimizes traffic in each spoke

Result: Repeaters, bridges, and switches create ONE large network using same protocols.

Devices for Different-Type Networks:

WiFi network

AP
Router Router

Router Ethernet network

AP

WiFi network

Image Description: Shows two WiFi networks (each with an AP and multiple devices in star
configuration) and one Ethernet network (bus configuration with multiple computers). Three
routers connect these different network types together, forming an internet.

Router:

• Connects incompatible networks to form internet (network of networks)

• Each original network maintains individuality and autonomy
• Special purpose computers for forwarding messages

Functions:

• Forwards messages between networks

• Uses internet-wide addressing system
• Maintains forwarding table for routing decisions

Addressing:

• Each device gets TWO addresses:

o Local address within its network
o Internet address for inter-network communication

Message Flow Example:

 1. WiFi machine sends to Ethernet machine
2. First sends to AP in its network
3. AP sends to associated router
4. Router forwards to router at Ethernet
5. Given to machine on bus
6. Machine forwards to final destination

Gateway:

• Point where network links to internet

• Can be just the router
• Or router + other devices (like AP)
• Often both packaged in single unit (home networks)

Methods of Process Communication

Interprocess Communication: Communication between processes executing on different

computers (or same machine via multitasking)

Client/Server Model:

Client Client

Server

Client Client

a. Server must be prepared to serve multiple clients at an y time.

Peer Peer

b. Peer s communicate as equals on a one-to-one basis.

Image Description:

• Part a (Client/Server): Shows one central Server in middle connected to four Clients
arranged around it. Caption: "Server must be prepared to serve multiple clients at any
time."
• Part b (Peer-to-Peer): Shows two Peers connected directly to each other on equal
footing. Caption: "Peers communicate as equals on a one-to-one basis."
Client/Server Roles:

• Client: Makes requests of other processes

• Server: Satisfies requests made by clients

Early Applications:

• Print Server: Single high-quality printer available to all network machines

• File Server: Machine with high-capacity storage containing organization's records

Characteristics:

• Server must execute continuously

• Prepared to serve clients at any time
• Used extensively in modern network applications

Peer-to-Peer (P2P) Model:

Characteristics:

• Processes provide service TO and receive service FROM each other

• Equal relationship, not hierarchical
• Usually temporary execution (not continuous like servers)

Applications:

• Instant messaging
• Interactive games
• File distribution (music, movies)

File Distribution:

• One peer receives file from another

• Then provides that file to other peers
• Collection called swarm
• Contrast to client/server central distribution

Advantages:

• Distributes service task over many peers

• More efficient than centralized server
• No single point of failure

Disadvantages:

• Lack of central server makes copyright enforcement difficult

• Still subject to legal action for copyright infringement
Important Note: "Peer-to-peer network" is misnomer—P2P is communication model, not
network property. Same network can support both P2P and client/server models.

Distributed Systems

Definition: Software systems consisting of units executing as processes on different

computers

Examples:

• Global information retrieval systems

• Company-wide accounting/inventory systems
• Computer games
• Network infrastructure control software

Evolution:

• Early: Developed independently from scratch

• Today: Common infrastructure revealed
• Prefabricated systems provide basic infrastructure
• Developers focus on unique application parts

Types of Distributed Computing:

1. Cluster Computing:

• Many independent computers work closely together

• Provide computation/services comparable to larger machine
• Benefits:
o Lower cost than supercomputer
o Higher reliability
o Lower maintenance costs
o High-availability: At least one cluster member can answer request
o Load-balancing: Workload shifted automatically

2. Grid Computing:

• More loosely coupled than clusters

• Work together for large tasks
• Examples: Condor (Wisconsin), BOINC (Berkeley)
• Often on computers used for other purposes
• Volunteer computing power when idle
• Millions of home PCs work on complex problems

3. Cloud Computing:

• Latest trend in distributed systems

• Huge pools of shared computers
 • Allocated to clients as needed
• Like metropolitan electrical grids eliminated need for generators

Examples:

• Amazon Elastic Compute Cloud: Rent virtual computers by hour

• Google Drive/Apps: Collaborate without knowing computer locations

Benefits:

• Reasonable reliability and scalability guarantees

Concerns:

• Privacy issues
• Security issues
• May not know who owns/operates computers we use

4.2 The Internet

Origin: Research projects from early 1960s

• Goal: Link variety of networks to function as connected system

• Not disrupted by local disasters
• Sponsored by U.S. government through DARPA

Evolution:

• Government-sponsored → Academic research → Commercial undertaking

• Today: Worldwide combination of PANs, LANs, MANs, WANs
• Millions of computers connected
Internet Architecture

Tier-1 ISPs

Tier-2 ISPs

Access ISPs

End systems

Image Description: Pyramid/hierarchical diagram showing four levels:

• Top: Tier-1 ISPs (interconnected cloud representing backbone)

• Second: Tier-2 ISPs (multiple clouds connected to tier-1)
• Third: Access ISPs (smaller clouds connected to tier-2)
• Bottom: End systems (individual devices connected to access ISPs)

ISP (Internet Service Providers): Organizations that construct and maintain networks

Hierarchical Structure:

1. Tier-1 ISPs (Top level):

• Very high-speed, high-capacity international WANs

• Backbone of Internet
• Relatively few in number
• Operated by large communications companies
• Example: Traditional telephone company expanded into other services

2. Tier-2 ISPs (Middle level):

• More regional in scope

• Less potent capabilities than tier-1
• Distinction from tier-1 often matter of opinion
• Operated by communications businesses
• Connect to tier-1 ISPs

Core of Internet:

• Tier-1 and tier-2 = networks of routers

• Collectively provide communication infrastructure
3. Access/Tier-3 ISPs (Access level):

• Independent internet (sometimes called intranet)

• Operated by single authority
• Supply Internet access to homes and businesses
• Examples:
o Cable companies (charge for service)
o Telephone companies (charge for service)
o Universities (free to members)
o Corporations (free to members)

4. End Systems/Hosts (User level):

• Devices individual users connect

• Laptops, PCs increasingly diverse
• Also: Telephones, video cameras, automobiles, appliances
• Any device benefiting from communication

Connection Technologies:

Wireless Connections:

• Fastest growing
• Based on WiFi technology
• Strategy: Connect AP to access ISP
• Provides Internet access within AP's broadcast range

Hot Spots:

• Area within AP or group of APs' range

• Particularly when publicly available or free
• Found in: Residences, hotels, offices, businesses, parks, entire cities

Cellular Technology:

• Similar to WiFi
• Hot spots called cells
• "Routers" coordinated for continuous service
• As end system moves cell to cell

Wired Connections:

• Telephone lines
• Cable/satellite systems
• Direct connection to end system OR
• Connection to customer's router (multiple end systems)
• Popular for residences: Local hot spot via router/AP
Last Mile Problem:

Background:

• 20th century networks designed for analog (voice, pre-digital TV)

• Modern networks carry digital data
• Older analog infrastructure still significant portion of Internet

Issue:

• Main arteries easy to modernize (fiber optics)

• Costly to replace copper/coaxial to individual homes/offices
• Data travels continents on high-speed digital
• Traverses "last mile" on slow, century-old analog line

Solutions:

• DSL modems
• Cable modems
• Satellite uplinks
• Direct fiber-optic connections to home
• All bring broadband Internet access to end users

Internet Addressing

IP Addresses: Unique identifying addresses for each computer

• Term IP = "Internet Protocol"

• Originally 32 bits
• Converting to 128 bits (IPv6) currently underway

Assignment:

• ICANN (Internet Corporation for Assigned Names and Numbers) awards blocks to
ISPs
• Nonprofit corporation coordinating Internet operation
• ISPs allocate addresses within their blocks
• Result: All machines have unique IP addresses

Dotted Decimal Notation:

Traditional way to write IP addresses

• Bytes separated by periods

• Each byte as base-10 integer
Examples:

• 5.2 = binary 0000010100000010

o Byte 00000101 (5) + byte 00000010 (2)
• 17.12.25 = three-byte pattern
o 00010001 (17) + 00001100 (12) + 00011001 (25)
• Full 32-bit address: [Link]

Mnemonic Addressing System:

Why Needed: Bit patterns not conducive to human use

Domain Concept:

• "Region" of Internet operated by single authority

• University, club, company, government agency
• May not correspond to physical area

Registration:

• Must register with ICANN

• Handled by companies called registrars
• Assigned unique domain name
• Often descriptive of organization

Example: Marquette University = [Link]

Top-Level Domains (TLDs):

• .edu - Educational institutions

• .com - Commercial institutions
• .gov - U.S. Government institutions
• .org - Nonprofit organizations
• .museum - Museums
• .info - Unrestricted use
• .net - Originally ISPs, now broader
• Country-code TLDs: .au (Australia), .ca (Canada)

Domain Structure:

• Extended to LEFT, separated by periods

• Individual host: [Link]
• With subdomains: [Link]
o Computer: overthruster
o Subdomain: propulsion
o Domain: yoyodyne
o TLD: com
Important: Dotted notation in mnemonic addresses NOT related to dotted decimal notation
for bit patterns

DNS (Domain Name System):

Purpose: Convert mnemonic addresses to IP addresses

Process:

1. Human identifies destination by mnemonic address

2. Software must convert to IP address before transmitting
3. Conversion uses name servers (directories)
4. DNS lookup: Process of translation

Name Servers:

• Essentially directories
• Provide address translation services to clients
• Used collectively as Internet-wide directory system

Implementation Models:

Traditional Model:

• Organization with resources maintains own name server

• Contains all names within domain
• Original basis of domain system
• Each domain represented physical region
• Operated by local authority (company, university, agency)
• Authority = access ISP
• Provided Internet access via own intranet
• Maintained own name server

Modern Alternative:

• Small organizations/individuals want domain presence

• Don't have resources for full implementation
• Example: Chess club wants [Link]
o Can't establish own network
o Can't maintain Internet link
o Can't implement own name server

Solution:

• Contract with access ISP

• Create appearance of registered domain
• ISP registers name
• ISP includes name in ISP's name server
 • All DNS lookups directed to ISP's name server
• Many domains reside within single ISP
• Each occupying small portion of single computer

Internet Applications

Evolution:

• Earlier days: Separate, simple programs

• Each followed network protocol
• Now: Handled by webpages via HTTP

Traditional Protocols:

• NNTP (Network News Transfer Protocol): Newsreader

• FTP (File Transfer Protocol): File listing/copying
• Telnet/SSH (Secure Shell): Remote computer access

Electronic Mail (Email):

Modern Systems:

• Many message exchange systems exist

• IM, browser chatting, Twitter, Facebook
• Email: Oldest, most enduring

User Applications:

• Microsoft Outlook
• Apple Mail
• Mozilla Thunderbird
• Browsers

Actual Transmission: Domain of basic network protocols like SMTP

SMTP (Simple Mail Transfer Protocol):

Defines how two computers interact when transmitting email

Example Scenario:

• Mail server [Link]

• Sending from user "dalek"
• To user "doctor" in domain [Link]

Process:
 1. Mail handling process contacts destination mail server
2. Uses DNS to map domain name to mail server name to IP address
3. Like looking up phone number before dialing
4. Server answers, identifies itself per protocol

SMTP Transcript Example:

1 220 [Link] SMTP Sendmail Gallifrey-1.0; Fri, 23 Aug 2413 14:34:10

2 HELO [Link]
3 250 [Link] Hello [Link], pleased to meet you
4 MAIL From: dalek@[Link]
5 250 2.1.0 dalek@[Link]... Sender ok
6 RCPT To: doctor@[Link]
7 250 2.1.5 doctor@[Link]... Recipient ok
8 DATA
9 354 Enter mail, end with "." on a line by itself
10 Subject: Extermination.
11
12 EXTERMINATE!
13 Regards, Dalek
14 .
15 250 2.0.0 r7NJYAEl028071 Message accepted for delivery
16 QUIT
17 221 2.0.0 [Link] closing connection

Line-by-Line Breakdown:

• Line 1: Remote server announces name, protocol, version, date/time

• Line 2: Sending server introduces itself (HELO command)
• Line 3: Remote server acknowledges ("pleased to meet you" = human-friendly)
• Line 4: Sending server announces message, identifies sender
• Line 5: Remote acknowledges will receive from this user/domain
• Line 6: Sending server announces recipient
• Line 7: Remote acknowledges will receive for that user
• Line 8: Sending server ready to send DATA (message body)
• Line 9: Remote ready to receive (code 354 per SMTP protocol)
• Lines 10-14: Actual email message text
• Line 15: Remote acknowledges acceptance
• Line 16: Sending server announces QUIT
• Line 17: Remote acknowledges closing connection

Protocol Details:

• Keywords HELO, MAIL, RCPT, DATA, QUIT precisely defined

• Numeric response codes enumerated and defined
• Software designers use descriptions to develop algorithms
 • Originally built on trust (abused by spammers)
• Modern servers use extended SMTP for security

Other Email Protocols:

MIME (Multipurpose Internet Mail Extensions):

• SMTP originally designed for ASCII text

• MIME converts non-ASCII data to SMTP compatible form

POP3 (Post Office Protocol version 3):

• Pronounced "pop-THREE"
• Simpler of two access protocols
• Downloads messages to local computer
• Read, stored, edited, manipulated locally
• Uses local machine's mass storage

IMAP (Internet Mail Access Protocol):

• Pronounced "EYE-map"
• Stores/manipulates messages on mail server
• User accessing from different computers
• Records maintained at server
• Accessible from any remote computer

VoIP (Voice over Internet Protocol):

Definition: Uses Internet infrastructure for voice communication (like traditional phones)

Simplest Form:

• Two processes on different machines

• Transfer audio data via P2P model
• No significant technical problems

Challenges Beyond Basic:

• Initiating and receiving calls

• Linking with traditional telephone systems
• Emergency 911 communication
• Government concerns (some tax/outlaw completely)

Four Types of VoIP Systems:

1. VoIP Soft Phones:

• P2P software
 • Two or more PCs share call
• Hardware: Speaker and microphone only
• Example: Skype
o Links to traditional telephone system
o Drawback: Proprietary system
o Operational structure not publicly known
o Must trust software integrity without verification
o PC must stay connected to receive calls
o PC resources may support other Skype communications

2. Analog Telephone Adapters:

• Devices connecting traditional telephone

• Phone service provided by access ISP
• Frequently bundled with Internet/digital TV service

3. Embedded VoIP Phones:

• Devices replacing traditional telephone

• Equivalent handset connected directly to TCP/IP network
• Common for large organizations
• Replacing copper wire systems
• VoIP over Ethernet reduces costs, enhances features

4. Smartphone Wireless VoIP:

• Earlier generations: Company's protocols only

• Internet access via gateways (converted to TCP/IP)
• 4G network: IP-based throughout
• 4G telephone = broadband-connected host on Internet

Wireless Phone Generations:

Evolution every ~10 years since 1980s:

• 1G (First Generation): Analog voice signals through air

• 2G (Second Generation): Digital signals, text messaging
• 3G (Third Generation): Higher data rates, mobile video calls
• 4G (Fourth Generation): Even higher rates, fully packet-switched IP network

Internet Multimedia Streaming:

Scale: Enormous portion of current Internet traffic

• Netflix: 4+ billion hours in first 3 months of 2013

• Netflix + YouTube: >50% of Internet bandwidth in 2014

Streaming Approaches:
N-unicast:

• Server sends individual messages to each client

• Real-time basis
• Drawback: Substantial burden on server and neighbors
• Unicast = one sender to one receiver
• N-unicast = single sender with multiple unicasts

P2P Alternative:

• Once peer receives data, distributes to waiting peers

• Distribution problem transferred from source to peers
• Reminiscent of file-sharing systems

Multicast:

• Transfers distribution to Internet routers

• Server transmits to multiple clients via single address
• Routers recognize significance, produce/forward copies
• Requires expanded router functionality
• Implemented in small networks
• Not yet global Internet

On-Demand Streaming:

• Most applications now this category

• User expects to view/listen at arbitrary time
• Can start, pause, rewind at own pace
• Different from Internet radio example
• N-unicast and multicast of little help
• Each stream = unicast from media server to user

Content Delivery Networks (CDNs):

Essential for scaling to thousands/millions of users

Characteristics:

• Groups of servers distributed strategically

• Specialize in streaming copies
• Located in network "neighborhoods" near users
• May reside in access ISP network
• High-speed streaming from nearby server
• Much closer than central server

Anycast Technology:

• Enables automatic connection to closest server

• From defined group of servers
• Makes CDNs practical
Device Proliferation:

• Beyond traditional PCs

• Televisions
• DVD/Blu-ray players
• Smartphones
• Game consoles
• All connect directly to TCP/IP network
• Select from free and subscription servers

4.3 The World Wide Web

Origins:

• Work of Tim Berners-Lee

• Realized potential: Internet + linked-documents (hypertext)
• First software: December 1990

Early Prototype:

• No multimedia support yet

• Key components included:
o Hypertext document format with hyperlinks
o Protocol for transferring hypertext
o Server process supplying pages on request

Growth:

• Quickly added images, audio, video

• Mid-1990s: Dominant application powering Internet growth

Web Implementation

Two Software Categories:

1. Browsers:

• Resides on user's computer

• Tasks:
o Obtain materials requested by user
o Present materials in organized manner
• Common examples:
o Firefox
o Safari
o Internet Explorer
o Chrome
2. Webservers:

• Resides on computer with hypertext documents

• Task: Provide access to documents under control
• Responds to client (browser) requests

HTTP (Hypertext Transfer Protocol):

• Protocol for transferring documents

• Between browsers and webservers

URL (Uniform Resource Locator):

[Link]

Mnemonic name of Document name

host holding the
document
Protocol required Directory path
to access the indicating the
document. In location of the
this case it is document within
hypertext transfer the host's
protocol (ht tp). file system

Image Description: Diagram breaking down URL:

[Link]

Labels point to each component:

• Protocol: http - "Protocol required to access the document. In this case it is hypertext
transfer protocol (http)"
• Mnemonic address: [Link] - "Mnemonic name of host holding the document"
• Directory path: /authors/Shakespeare/ - "Directory path indicating the location of the
document within the host's file system"
• Document name: Julius_Caesar.html - "Document name"

Purpose: Unique address for each document

• Contains info for browser to contact server

• Request desired document

Four Segments:

1. Protocol to communicate with server

2. Mnemonic address of machine with server
3. Directory path to find document
4. Document name
Example Interpretation: URL tells browser:

• Contact webserver on [Link]

• Using protocol HTTP
• Retrieve Julius_Caesar.html
• From /authors/Shakespeare/ directory

Shortened URLs:

May not contain all segments:

• No directory path if not needed

• May be protocol + mnemonic address only
• Returns predetermined home page
• Describes information at website

Example: [Link]

• Leads to Google home page

• Contains hyperlinks to services/products/documents

Browser Convenience:

• Many assume HTTP if no protocol specified

• Retrieve Google with just: [Link]

HTML (Hypertext Markup Language)

Definition: System of tags describing:

• Document appearance on screen

• Multimedia resources to accompany
• Items linked to other documents

Structure: Similar to text file

• Text encoded character-by-character (ASCII/Unicode)

• PLUS special symbols called tags

Purpose: Author describes information browser needs:

• How to present page on screen

• How to find related documents

Analogy:

• Like adding typesetting directions to typed text (red pen)

• Tags replace red markings
 • Browser = typesetter
• Reads tags to present on screen

Simple Webpage Example:

a. The page encoded using HTML.

Tag indicating
beginning of
document <html>
<head>
Preliminaries
<title>demonstration page</title>
</head>
The part of the document <body>
that will be displayed by a
browser <h1>My Web Page</h1>
<p>Click here for another page.</p>
Tag indicating end of
</body>
document

</html>

b. The page as it would appear on a computer screen.

My Web Page
Click here for another page.

Image Description: Two parts:

• Part a: HTML source code showing structure with labels:

o "Tag indicating beginning of document" (html)
o "Preliminaries" (head section)
o "The part of the document that will be displayed by a browser" (body section)
o "Tag indicating end of document" (/html)
• Part b: Browser display showing:
o Large heading: "My Web Page"
o Text: "Click here for another page."

HTML Source Code:

html
<html>
<head>
<title>demonstration page</title>
</head>
<body>
<h1>My Web Page</h1>
<p>Click here for another page.</p>
</body>
</html>

Tag Delineation: Symbols < and >

Two Sections:

1. Head (<head> ... </head>):

• Preliminary information about document

• Like interoffice memo head (date, subject)
• Contains title (documentation purposes only)
• Not displayed on screen

2. Body (<body> ... </body>):

• "Meat" of document
• Material presented on screen

Body Contents in Example:

• Level-one heading (<h1> ... </h1>):

o Text: "My Web Page"
o Browser displays prominently
• Paragraph (<p> ... </p>):
o Text: "Click here for another page."

Current State: Not fully functional

• Clicking "here" does nothing

• Need to add link to another document

Adding Hyperlinks:
 a. The page encoded using HTML.

<html>
<head>
<title>demonstration page</title>
</head>
<body>
<h1>My Web Page</h1>
<p>Click
<a href="[Link]

here

</a>

for another page.</p> </body>

</html>

Anchor tag containing parameter

Closing anchor tag

b. The page as it would appear on a computer screen.

My Web Page
Click here for another page.

Image Description: Two parts:

• Part a: HTML with anchor tags added, labels pointing to:

o "Anchor tag containing parameter"
o "Closing anchor tag"
• Part b: Browser display identical to Figure 4.9b except "here" is now
highlighted/colored as clickable link

HTML with Anchor Tags:

html
<html>
<head>
<title>demonstration page</title>
</head>
<body>
<h1>My Web Page</h1>
<p>Click
<a href="[Link]
here
</a>
for another page.</p>
</body>
</html>

Process:

1. Surround word "here" with anchor tags: <a> ... </a>

2. Inside opening tag, insert parameter:
o href = [Link]
o href = "hypertext reference"
o URL following equal sign

Result:

• Word "here" highlighted by color

• Indicates link to another webpage
• Clicking retrieves and displays associated page
• This is how webpages link to each other

Adding Images:

Example Scenario:

• JPEG image stored as [Link]

• In directory Images at [Link]
• Available via webserver

Image Tag:

html
<img src="[Link]

Placement:

• Immediately after <body> tag → image at top

• Before </body> tag → image at bottom
• More sophisticated positioning techniques exist
How It Works:

• Browser finds tag

• Sends message to HTTP server at [Link]
• Requests image [Link]
• Displays image appropriately

Note: "src" = "source" (indicates where image comes from)

XML (eXtensible Markup Language)

HTML Essence: Notational system encoding:

• Text document
• Document's appearance
• As simple text file

XML Concept: Similar encoding for non-textual material

Sheet Music Example:

Traditional representation doesn't fit character-by-character format:

• Staffs
• Measure bars
• Notes

Solution: Develop alternative notation system

Example Tags:

• Staff start: <staff clef="treble">

• Staff end: </staff>
• Time signature: <time> 2/4 </time>
• Measure: <measure> ... </measure>
• Note: <notes> egth C </notes>

Sheet Music Encoding:

xml
<staff clef="treble"> <key>C minor</key>
<time> 2/4 </time>
<measure> <rest> egth </rest> <notes> egth G, egth G, egth G </notes></measure>
<measure> <notes> hlf E </notes></measure>
</staff>
Image Description: Musical notation showing first two bars of Beethoven's Fifth Symphony
on treble clef staff in 2/4 time, with three eighth note Gs followed by half note E-flat.

Benefits:

• Encode as text files

• Modify easily
• Store efficiently
• Transfer over Internet
• Software can:
o Present as traditional sheet music
o Play on synthesizer

XML Style Characteristics:

Our sheet music system uses same style as HTML:

• Tags delineated by < and >

• Beginning/end of structures: Same name tags
• Ending tag has slash (/)
• Special attributes in tags: clef="treble"

Same style applies to:

• Mathematical expressions
• Graphics
• Other formats

XML Definition:

Standardized style for designing notational systems

• Represents data as text files

• Simplified derivative of SGML (Standard Generalized Markup Language)

Following XML Standard:

Markup languages developed for:

• Mathematics
 • Multimedia presentations
• Music

HTML Relationship:

• HTML = markup language based on XML standard

• For representing webpages
• Original HTML predates XML standard
• Some HTML features don't strictly conform
• XHTML = version rigorously adhering to XML

Standards Design Benefits:

Rather than individual, unrelated markup languages:

• XML = standard for markup languages in general

• Languages developed with uniformity
• Can be combined for complex applications

Example: Text documents containing:

• Sheet music segments

• Mathematical expressions

Semantic vs. Appearance:

Traditional HTML: Emphasizes appearance

• Ingredients appear as list

• Each on separate line

Semantic XML: Emphasizes meaning

• Ingredients marked as ingredients

• Tags: <ingredient> ... </ingredient>
• Not just list items

Difference is Subtle but Important:

Semantic Approach Benefits:

• Search engines identify recipes:

o Containing certain ingredients
o NOT containing certain ingredients
• Substantial improvement over current state
Example:

• Current: "recipes containing/not containing certain words"

• Problem: Skips "This lasagna does not contain spinach"
• Semantic: Properly identifies ingredients vs. words

Vision:

• Internet-wide standard for semantic marking

• World Wide Semantic Web
• Not just World Wide Syntactic Web

Client-Side and Server-Side Activities

Simple Webpage Retrieval Process:

Using Figure 4.10 example:

1. Browser (client) uses URL to contact webserver

2. Asks page be transferred
3. Server sends HTML text document (Figure 4.10a)
4. Browser interprets HTML tags
5. Determines display format
6. Presents on screen (Figure 4.10b)
7. User clicks "here"
8. Browser uses URL in anchor tag
9. Contacts appropriate server
10. Obtains and displays another webpage

Summary: Browser fetches and displays as directed by user

Additional Requirements:

What if webpage needs:

• Animation
• Order form for customers
• Interactive features

Solution: Additional activities by browser OR webserver

Activity Classifications:

Client-Side Activities:

• Performed by client (browser)

 • Examples:
o Animation
o Form completion
o User input

Server-Side Activities:

• Performed by server (webserver)

• Examples:
o Customized webpage construction
o Database queries
o Processing submissions

Travel Agent Example:

Scenario: Customers identify destinations and dates

• Agent presents customized webpage

• Only information pertinent to customer's needs

Process:

1. Website provides page with available destinations

2. Customer specifies destinations and dates (client-side)
3. Information transferred to agent's server
4. Server constructs customized webpage (server-side)
5. Sent to customer's browser

Search Engine Example:

Process:

1. User specifies topic of interest (client-side)

2. Transferred to search engine
3. Customized webpage constructed (server-side)
4. Identifying documents of possible interest
5. Sent back to client

Web Mail Example:

Webserver = intermediary between client and mail server

Receiving Mail:
 • Webserver builds webpages from mail server info (server-side)
• Sends to client
• Browser displays (client-side)

Sending Mail:

• User creates messages (client-side)

• Sends to webserver
• Webserver forwards to mail server (server-side)
• For mailing

Technologies for Client/Server Activities:

Numerous Systems - each competing for prominence

Client-Side Technologies:

JavaScript:

• Early and still popular

• Developed by Netscape Communications
• Programs written within HTML source
• Browser extracts and follows as needed

Java Applets:

• Developed by Sun Microsystems

• Webpage transferred first
• Additional program units (applets) transferred
• As requested in HTML source
• Written in Java language

Flash:

• Developed by Macromedia
• Extensive multimedia presentations
• Client-side implementation

Server-Side Technologies:

CGI (Common Gateway Interface):

• Early means
• Set of standards
• Clients request program execution at server
Servlets:

• Variation of CGI approach

• By Sun Microsystems
• Clients cause program units to execute at server

JavaServer Pages (JSP):

• Simplified servlet approach

• For customized webpage construction
• Webpage templates stored at webserver
• Completed using client information

Active Server Pages (ASP):

• By Microsoft
• Similar to JSP
• Templates for customized webpages

PHP:

• Originally "Personal Home Page"

• Now "PHP Hypertext Preprocessor"
• Open source system
• Contrast to proprietary systems above

Security and Ethical Problems:

Client Side:

• Ethical: Servers transferring programs to clients

• Security: Client blindly executes any program from server
• Opens to malicious server activities

Server Side:

• Ethical: Clients causing programs to execute at server

• Security: Server blindly executes any program from client
• Could cause breaches and damage

Balance Needed: Functionality vs. Security

4.4 Internet Protocols

Focus: How messages transferred over Internet

 • Requires cooperation of all computers
• Software resides on every Internet computer

The Layered Approach to Internet Software

Origin Final destination

Prepares package Receives and

for shipping You Friend opens package

Removes package
Places package Shipping Shipping from container
in container company company and delivers it
for airline Intermediate stops to addressee

Places container Sends container

in airplane Airline Airline Airline Airline to shipping
company

Transfers container
to another airplane

Image Description: Three-level hierarchy from left (Origin) to right (Final destination) with
intermediate stops:

Origin Side:

• You: "Prepares package for shipping"

• Shipping company: "Places package in container for airline"
• Airline: "Places container in airplane"

Intermediate Stops:

• Airline: "Transfers container to another airplane" (multiple times)

Destination Side:

• Airline: "Sends container to shipping company"

• Shipping company: "Removes package from container and delivers it to addressee"
• Friend: "Receives and opens package"

Three-Level Hierarchy:

1. User level (you and friend)

2. Shipping company
3. Airline

Key Characteristics:
 • Each level uses next lower as abstract tool
• You not concerned with shipping company details
• Shipping company not concerned with airline operations
• Representatives at both origin and destination
• Destination reps do reverse of origin reps

Internet Software Structure:

Similar to Package Shipping:

• Four layers (not three)

• Software routines (not people/businesses)

Application

Transport

Network

Link

Image Description: Stacked boxes showing four layers from top to bottom:

1. Application
2. Transport
3. Network
4. Link

Message Flow:

1. Originates in application layer

2. Passed down through transport and network
3. Prepared for transmission
4. Transmitted by link layer
5. Received by link layer at destination
6. Passed back up hierarchy
7. Delivered to application layer at destination
Message Journey Through Layers:

At each intermediate stop

the network layer determines
the direction in which the
packet should be forwarded.

Prepares Receives
message Application Application message
and provides
destination
address

Chops message Collects packets

into packets Transport Transport and reassembles
message

Assigns Detects that

intermediate Network Network Network Network packet has
address to reached its
each packet final destination

Transfers Receives
packet Link Link Link Link packet

Origin Intermediate Final

stops destination

Image Description: Three sections (Origin, Intermediate stops, Final destination):

Origin (all 4 layers):

• Application: "Prepares message and provides destination address"

• Transport: "Chops message into packets"
• Network: "Assigns intermediate address to each packet"
• Link: "Transfers packet"

Intermediate stops (only 2 layers):

• Network and Link only

• Note: "At each intermediate stop the network layer determines the direction in which
the packet should be forwarded"

Final destination (all 4 layers):

• Link: "Receives packet"

• Network: "Detects that packet has reached its final destination"
• Transport: "Collects packets and reassembles message"
• Application: "Receives message"
Layer-by-Layer Details:

1. Application Layer (Top):

Consists of:

• Software units (clients and servers)

• Using Internet communication for tasks
• NOT restricted to application software
• Also includes utility packages

Examples:

• FTP (File Transfer Protocol) software

• SSH (Secure Shell) for remote login
• Normally considered utility software

Responsibilities:

• Originate messages
• Provide Internet-compatible addresses
• May use name servers (DNS)
• Translate mnemonic to IP addresses

Analogy: Like using shipping company

• Your responsibility: Provide compatible address

• Application layer: Provide Internet-compatible address

2. Transport Layer:

Main Tasks:

• Accept messages from application layer

• Ensure proper formatting for Internet transmission

Segmentation Process:

• Divides long messages into small segments

• Transmitted as individual units
• Why? Long message obstructs other messages at routers
• Like cars waiting for long train at crossing
• Small segments can interweave at router crossings

Packet Creation:
 • Adds sequence numbers to segments
• For reassembly at destination
• Segments now called packets
• Hands packets to network layer

Important Note:

• From this point: Packets treated as individual, unrelated

• Until reach transport layer at destination
• Possible for packets to follow different paths

3. Network Layer:

Main Job: Decide packet direction at each step

Router Software:

• Network layer + link layer = software on routers

• Network layer maintains forwarding table
• Uses table to determine direction

At Origin:

• Receives packet from transport layer

• Uses forwarding table
• Determines initial direction
• Hands packet to link layer for transmission

4. Link Layer:

Responsibility: Transfer the packet

Must Handle:

• Communication details for specific network

• If Ethernet: Applies CSMA/CD
• If WiFi: Applies CSMA/CA

At Intermediate Stops:

Reception:

• Link layer receives transmitted packet

• Hands up to network layer

Processing:
 • Network layer compares destination to forwarding table
• Determines next step direction
• Returns packet to link layer

Forwarding:

• Link layer forwards along its way

• Result: Packet "hops" machine to machine

Only Two Layers Involved:

• Link and network only at intermediate stops

• These only layers present on routers
• Tightly integrated for minimal delay
• Router forward time: Millionths of second

At Final Destination:

Network Layer Recognition:

• Recognizes packet journey complete

• Hands packet to transport layer (not forwarding)

Transport Layer Assembly:

• Receives packets from network layer

• Extracts underlying message segments
• Reconstructs original message
• Uses sequence numbers from origin
• Once assembled: Hands to application layer
• Message transmission complete

Port Numbers:

Purpose: Determine which application unit receives message

Process:

• Unique port numbers assigned to application units

• NOT related to I/O ports (Chapter 2)
• Port number appended to message address
• Before starting journey
• Transport layer at destination:
o Reads port number
o Hands message to that application
Universal Standards:

• Common applications have accepted port numbers

• Users rarely need to know

Examples:

• HTTP: Port 80
o URL: [Link]
o Browser assumes contact HTTP server at port 80
• SMTP: Port 25
o Email client assumes communicate via port 25

Summary of Communication:

Four layers interact:

1. Application layer: Messages from application viewpoint

2. Transport layer:
o Converts to Internet-compatible segments
o Reassembles received messages
o Delivers to appropriate application
3. Network layer: Directs segments through Internet
4. Link layer: Actual transmission machine to machine

Response Time: Measured in milliseconds

• Many transactions appear instantaneous

• Amazing given all this activity!

The TCP/IP Protocol Suite

Need for Standards:

• Open networks require published standards

• Manufacturers supply compatible equipment/software
• Products function with other vendors

OSI Reference Model:

• By International Organization for Standardization

• Seven-level hierarchy
• Often quoted (international authority)
• Slow to replace four-level view
• Established AFTER four-level became de facto standard
TCP/IP Protocol Suite:

Collection of protocol standards for Internet

• Implements four-level communication hierarchy

Misleading Name:

• TCP and IP = only TWO protocols

• Vast collection of many protocols
• Named for two most prominent

Transport Layer Options:

Application layer

?
Transpor t
layer

TCP UDP

More “reliable” More efficient

but less efficient but less “reliable”

Image Description: Shows Application layer at top with question mark arrow pointing down
to Transport layer box, which splits into two options:

• TCP: "More 'reliable' but less efficient"

• UDP: "More efficient but less 'reliable'"

TCP (Transmission Control Protocol):

• Defines VERSION of transport layer

• NOT the only option

UDP (User Datagram Protocol):

• Another transport layer option

• Different characteristics

Analogy: Like shipping companies

• Each offers same basic service

 • With own unique characteristics
• Choose based on quality of service required

TCP vs UDP Differences:

1. Connection Establishment:

TCP:

• Before sending application message:

o Sends own message to destination transport layer
o Says message about to be sent
o Waits for acknowledgment
• Connection-oriented protocol
• Establishes connection before sending

UDP:

• Does NOT establish connection

• Merely sends message to address
• Forgets about it
• Destination might not even be operational
• Connectionless protocol

2. Reliability:

TCP:

• Origin and destination work together

• Uses acknowledgments
• Packet retransmissions
• Assures all segments successfully transferred
• Reliable protocol

UDP:

• Does NOT offer retransmission services

• Unreliable protocol

3. Flow and Congestion Control:

TCP Provides:

Flow Control:
 • Transport layer at origin can reduce transmission rate
• Prevents overwhelming destination counterpart

Congestion Control:

• Transport layer at origin adjusts transmission rate

• Alleviates congestion between origin and destination

UDP: Does NOT provide these controls

UDP is NOT Poor Choice:

Advantages:

• More streamlined than TCP

• More efficient
• If application prepared to handle consequences:
o Might be better choice

Use Cases:

UDP Preferred:

• DNS lookups (efficiency important)

• VoIP (Voice over IP - speed critical)

TCP Preferred:

• Email (less time sensitive, reliability important)

• File transfers

IP (Internet Protocol):

Standard for: Network layer implementation

Two Main Tasks:

1. Forwarding:

• Relaying packets through Internet

2. Routing:

• Updating forwarding table

• Reflects changing conditions
Routing Scenarios:

• Router malfunctions → Don't forward that direction

• Internet section congested → Route around blockage

IP Standard for Routing:

• Protocols for communication among neighboring network layers

• Interchange routing information

Hop Count / Time to Live:

Feature: Each IP network layer at origin:

• Prepares packet
• Appends hop count value (also called time to live)

Purpose:

• Limit on number of times packet should be forwarded

• As it finds way through Internet

Process:

• Each IP network layer forwards packet

• Decrements hop count by one
• With this info: Can protect Internet
• Prevents packets circling endlessly

Sufficient Value:

• Initial hop count of 64

• More than sufficient for today's Internet
• Despite daily growth

IPv4 vs IPv6:

IPv4 (IP version four):

• Used for years

• Implementing network layer
• 32-bit internet addressing system

Problem: Internet rapidly outgrowing 32-bit addresses

IPv6 (IP version six):

 • New version established
• 128-bit internet addresses
• Solves address shortage
• Other improvements: Multicast support

Conversion:

• From IPv4 to IPv6 currently underway

• Alluded to in Section 4.2
• Expected: 32-bit addresses extinct by 2025

4.5 Security

Reality: Computer connected to network:

• Subject to unauthorized access

• Subject to vandalism

Forms of Attack

Many Ways to attack computer system via network connections

Malware (Malicious Software): Collectively, software designed to harm

Two Attack Methods:

1. Transferred to and executed on computer itself

2. Attacks computer from distance

Types of Threats:

1. Virus:

• Computer program adversely affecting computers

• Propagates through network without user consent
• Uses other programs to spread (e.g., email client)
• Requires user action

2. Worm:

• Similar to virus
• Can propagate independently (self-spreading)
• Doesn't need other programs
• More dangerous - faster spread
Modern Viruses/Worms:

• Authors know most users have antivirus

• Designed to cause maximum damage quickly
• Within minutes of release

3. Phishing:

• Masquerades as trustworthy entity

• In electronic communication
• Attempts to compromise user

Early Attacks:

• Acquire usernames, passwords, credit cards

Common Pattern:

• Most people receive 1-2 per week

• Appear from banks
• Lead to fake website (looks like bank)
• Ask for username/password
• "Make some correction"

Reality:

• Emails and websites NOT legitimate

• Careful URL examination reveals compromise
• Hosted at compromised server

Users can easily fall victim

4. Trojan Horse / Malware:

Malware Definition:

• General term for exploitative software/code

• Without user consent

Trojan Horse Technique:

• Malware author creates seemingly useful software

• Distributes for free
• Unsuspecting users download and install
• Malware installed along with it
Network Attack Characteristics:

• Can execute from distance (even another country)

• May not be visible to conventional security
• Distributed Denial of Service (DDoS): Overwhelming systems

Protection and Cures

Security Controls: Safeguards to minimize threat impact

Three Types:

1. Physical Controls:

• Traditional non-technical prevention

• Prevent unauthorized facility access
• Examples:
o Locks
o Fire extinguishers
o Background checks
o Doors

2. Procedural Controls:

• Prescribed plans of action

• Govern computer resource use
• Examples:
o Account obtaining procedures
o Privilege escalation procedures
o Program modification procedures
o Hiring procedures
o Password change requirements

3. Technical Controls:

• Built into information system

• Examples:
o Passwords
o Firewalls
o Intrusion detection systems
o System updates
o Antivirus software

Control Effectiveness:
Rudimentary Controls:

• Block majority of threats

• Examples: Firewalls, passwords, backups, locks

Reality:

• Even best controls have holes

• User behavior creates weaknesses:
o Prefer memorable over secure passwords
o Irregular backup practices
• Threats exploit these weaknesses

Defense-in-Depth: Recommended approach

• Multiple layers of security

• If one fails, others provide protection

Encryption

Purpose: Protect data confidentiality

• During transmission
• During storage

Basic Concepts:

• Scrambles data into unreadable format

• Requires key to decrypt

Uses:

• Email
• Messaging
• File storage
• Network communication

Legal Approaches to Network Security

Key Legislation:

Computer Fraud and Abuse Act (1986):

• Made crime to break into federal/commercial systems

• Response to early hacking (Gang of 414's)
HIPAA (1996):

• Health Insurance Portability and Accountability Act

• Protected patient health record confidentiality
• Pushed for electronic health records
• Major impact on healthcare information security

Sarbanes-Oxley Act (2002):

• Response to corporate frauds (Enron, WorldCom)

• Made executives personally accountable
• Required formal internal controls (Section 404)
• Major impact on information security profession
• Significant investments in publicly traded firms

Organizations:

CERT/CC (CERT Coordination Center):

• Established after Morris worm (1988)

• At Carnegie Mellon University
• Coordinates industry-government response
• Internet security "watchdog"
• Investigates security problems
• Issues security alerts
• Public awareness campaigns

US Cyber Command (2009):

• Created after F-35 and grid intrusions

• Defends US military computer networks
• Responds to cyber attacks
• Military-scale cybersecurity operations

Chapter 15: Computer Networks (EIT Module)

Overview

Definition: Interconnection of information systems through components designed to

communicate using standardized technologies

Historical Context:
 Image Description: Historical photograph
of telegraph device showing mechanical
apparatus with electromagnet and marker
system used to scratch marks on paper.

Telegraph (1840):

• Patented by Samuel Morse

• First data communication device
• Used to send information across great
distances

How It Worked:

1. Sender device connects/releases switch

2. Energizes electromagnet on receiver device
3. Electromagnet pulls marker to one side
4. Marker scratches line on paper

Morse Code:

• Encoding of marks (dots and dashes)

• Energy generated data people can understand
• Example: Letter 'a' = dot and dash

Evolution:

• Over 100 years of innovations

• Eventually motivated standardization

Need for Standardization:

Problem:

• Computers from different manufacturers

• From different countries
• Needed to network together
• Components had difficulty interoperating
• Different vendors' equipment incompatible

Solution:

• Standards organizations developed models

• Could be adopted by entire industry
 • Innovation while maintaining compatibility
• Example: Standard functionality with less power consumption

The Internet

Image Description: Photograph of spider web with

dewdrops, illustrating interconnected nature of
Internet with multiple traceable paths between any
points.

Definition: Interconnection of individual computers

across world through networks using standardized
communication protocols

Spiderweb Analogy:

• Each new direction continuously connected

• Can trace multiple directions from any point
• Similar to Internet:
o Computers connected by specialized
hardware
o Can trace communication in multiple
directions
o Web-like design

World Wide Web:

What people use daily:

• Online shopping
• Ask Siri (Apple's digital assistant)
• Post videos to Instagram
• Social media platforms

Growth:

• Through web browser applications

• Navigate content (webpages)
• Documents on computers worldwide

Standardized Protocols Needed:

• Display content consistently

• Navigate effectively
HTTP (Hypertext Transfer Protocol):

Image Description: Screenshot of browser address bar showing "[Link]

with lock icon indicating secure connection. Google search page visible below.

Purpose: Internet protocol for World Wide Web

• Standardizes webpage transfer across systems

• HTTPS = Secure version (shown in browsers)

Browser Function:

• Applies HTTPS protocol automatically

• Communicates Google home page to screen
• Keeps users compliant with HTTP requirements
• Access content without worrying about complexities

TCP/IP Stack

Background:

• Internet technologies standardized

• Constructed as stacked layers
• Originally: OSI (Open Standards Interconnection) Model
• Today: Simplified as TCP/IP stack

Five-Layered Network Architecture:

Layer # Layer Name Networking Task
5 Application Specify needs of users
4 Transport Organize data for network transmission
3 Network Identify and locate destination network
2 Data Link Remove errors, label devices
1 Physical Signals transmitted across wire

Physical Layer

Purpose: Transmit information over distance using signals across physical medium

Physical Media Types:

• Copper wire
• Optical fiber
• Wireless (cellular, Wi-Fi)

Signal Types:

Image Description: Graph showing two types of signals:

• Digital signal as square waves (on/off pattern representing 1s and 0s)

• Analog signal as smooth continuous sine wave

Digital Signal:

• Energy source turns on and off

• Energy present = 1
• Energy absent = 0
• Binary data representation

Analog Signal:
 • Continuous energy applied to medium
• Changes in amplitude and frequency
• Forms sine wave
• Varies in intensity and time
• Data encoded by varying amplitude/frequency or both

Binary Data:

1s and 0s from signals

• Can be encoded to represent characters

• Humans can understand

ASCII (American Standard Code for Information Interchange):

• Numerical representations (decimals)

• Converts English letters to binary

Example - "Hello" in ASCII:

Character ASCII Decimal Binary

h 104 01101000
e 101 01100101
l 108 01101100
l 108 01101100
o 111 01101111

Copper Cable (Cat5e):

Image Description: Photo of Cat5e cable with RJ45 connector showing eight coloured wires
visible in clear connector. Color-coded twisted pairs clearly visible.

Characteristics:

• Common in offices and schools

• RJ45 connector on end
• Excellent conductor of electricity
 • Carries signals across great distances

Four Twisted Pairs (color-coded left to right):

• White-Orange + Orange
• White-Blue + Blue
• White-Green + Green
• White-Brown + Brown

Why Color Code Matters:

• Each wire carries different signal type

• Must match signal sequence of receiving
devices
• PCs, laptops, printers

Tight Twisting:

• Improves signal transmission rate

• Improves data transfer speed
• Data transfer rate: Bits per second

Speed Capability:

• Cat5e: Up to 1000 Mbps (megabits per

second)
• 1 megabit = 1 million bits
• Can move 1 million bits of data per second!

Fiber Optic Cable:

Image Description: Cross-section diagram of fiber

optic cable showing multiple protective layers:

• Outer protective jacket

• Strength members
• Inner protective layers
• Glass fiber core in center (width of human hair)

Construction:

• Optical fiber bundled inside cable

• Protected layers prevent damage
• Inner glass fibers: Width of human hair

How It Works:

1. Energy source generates laser light

 2. Light travels through glass tube
3. Reaches destination

Signal Transmission:

• Light signal pulsed (on and off) by sending device

• Light-sensitive receiver on other end
• Converts pulses to 1s and 0s
o Light present = 1
o Light absent = 0

Data Link Layer

Functions:

1. Addressing: Label devices

2. Error Detection: Ensure signal arrives without errors

Why Necessary:

• Signals damaged while traveling

• Devices need to know if signal directed at them
• Get signal to destination without errors

Home Network Scenario:

Image Description: Illustration showing home router in center with multiple devices around
it: laptop, smartphone, tablet, smart TV.
Wireless signals indicated between devices
and router.

Typical Home Devices:

• PCs
• Smartphones
• Laptops
• Tablets
• Smart televisions
• Network storage

Connection Need:

• Router between devices and Internet

• Router described in Network Layer section

Example: Homework assignment submitted online

 • Want homework to reach final destination
• Arrive in exact state completed
• No errors
• This is where Data Link layer necessary

Network Interface Cards:

Connection Types:

• Wireless OR wired
• Between home device and router
• Connection = instance of Data Link layer

WNIC (Wireless Network Interface Card):

• Built inside home laptop

• Interface = connection technology
o Between laptop and router
o Or other networking device
• Common networking term

MAC Address (Media Access Control Address):

Also called physical address

• Unique identifier
• Assigned by hardware manufacturer
• Labeled on hardware itself

Finding MAC Address:

Easier ways when connected to Internet

Windows Example: Command: ipconfig /all

Output Example:

C:\Users\clinton> ipconfig /all

Wireless LAN adapter Wi-Fi:

Description............ : Intel® Wi-Fi AX200 160Hz
Physical Address....... : 6D-B1-00-5U-03-9R
DHCP Enabled........... : Yes
IPv4 Address........... : [Link]
Analysis:

• Active interface: Intel Wi-Fi AX200 160Hz (WNIC)

• Physical address (MAC): 6D-B1-00-5U-03-9R
• Data Link layer implemented in WNIC
• Physical address uniquely identifies device
• Plays important role in routing homework to destination

Error Detection:

Why Needed:

• Detect errors during signal transmission

• Errors from: Power outages, power spikes
• Technology must detect to improve reliability

Method: Specialized algorithms

CRC (Cyclic Redundancy Check):

• Algorithm used by networks

• Uses Modulo 2 arithmetic
• Calculates bit-level errors on binary data
• Continuously improving (keeps mathematicians employed!)

Simple Error-Detection Algorithm Example:

Note: Easy to understand but NOT robust for industrial use

Algorithm: Set of steps for desired output

• In this case: Detect error in transmitted data

Example: Send "HELLO" in text message

Step 1: Code letters as integers (alphabet position)

• H = 8, E = 5, L = 12, L = 12, O = 15

Step 2: Add integers 8 + 5 + 12 + 12 + 15 = 52

Step 3: Add digits of sum 5 + 2 = 7

Step 4: Send with checksum appended Transmitted: 8 5 12 12 15 7 (7 = checksum)

Receiving and Checking:

Receiver gets: 8 5 12 12 15 7

Step 1: Knows 7 is extra data (checksum)

Step 2: Calculates sum 8 + 5 + 12 + 12 + 15 = 52

Step 3: Adds digits 5 + 2 = 7

Step 4: Compares

• Calculated: 7
• Received: 7
• Match = No errors!

Algorithm Flaws:

Problem: Multiple messages can sum to same value

Example 1: 8 5 11 13 15 7

• Sum = 52, but translates to "HEKMO" (not HELLO)

Example 2: 10 5 11 11 15 7

• Sum = 52, but translates to "JEKKO" (not HELLO)

Our simple algorithm wouldn't detect these errors!

Solution: Mathematicians improve accuracy

• Complex algorithms detect all possible errors

• Math plays critical role in technology

Network Layer

Function: Transfer packets from source to destination computer

• Through one or more networks

• Also called routing

• Performed by routers
Image Description: Photo of home router with Cat5e cable and RJ45 connector allowing
access between home devices and Internet.

Home Router:

• Supplied by Internet Service Provider

• Connects home devices to global Internet
resources

Packets:

Definition: Small segment of larger data piece

sent over network

Example Scenario:

• Using Internet for homework research

• Open webpage with browser
• Packets sent from webserver (somewhere in world) to laptop

Process:

1. Website content NOT sent as one large file

2. Broken into small packets BEFORE transmission
3. Transmitted over Internet
4. Packets reach destination
5. Reassembled into original form (by Transport Layer)
6. Complete webpage viewed in browser

Internet Protocol (IP):

Most Common Network Layer Protocol

• Notice: Part of TCP/IP stack name

• Essential role in Network layer
• Standard responsible for routing packets across networks

Management:

• IT professionals configure routers

• Facilitate routing
• Assign IP addresses to devices

IP Address:
Definition: Unique identifier assigned to devices accessing network

Difference from MAC Address:

• MAC: Uniquely assigned by hardware manufacturer

• IP: Automatically OR manually assigned by technology
• Technology manages devices connecting to network/Internet

Finding IP Address:

From earlier ipconfig /all example:

IPv4 Address........... : [Link]

IPv4 (IP version 4):

• 4 sections of integers
• Range: 0 to 255
• Separated by periods
• Full range: [Link] to [Link]

History:

• Created when experts thought: Max 1 device per person

• IPv4 supports: 2³² ≈ 4.29 billion devices
• Enough at creation time

Problem:

• Today: Many users have multiple devices

• Began running out of IPv4 addresses

IPv6 (IP version 6):

Solution to address shortage

• Significantly longer addresses

• Integers AND letters

Capacity: 2¹²⁸ devices

• ≈ 340,282,366,920,938,463,463,374,607,431,768,211,456 devices!

Example:

2603:9000:f700:6347:1492:8241:c756:3812
Format:

• Four characters per section

• Separated by colons
• Contains more information
• Supports vastly more IP address combinations

Transport Layer

Function: Ensure reliable data delivery over network

Technology:

• Designed to track data

• As broken into small segments

Segmentation:

• Process of breaking data into smaller units

• Allows compact transmission over network using IP
• Necessary: IP has packet size limitations

Reassembly:

• Once all segmented data received

• Transport layer reassembles
• Back into original form
• Can be used by application (e.g., web browser)

TCP (Transmission Control Protocol):

Most Common Transport Layer Protocol

• Notice: Like IP, part of TCP/IP stack name

Example - Email:

1. Application transfers email message data to TCP

2. TCP breaks into small segments
3. Before transmission to Internet destination
4. Segments assigned sequence numbers
5. Receiving technology knows how to:
o Logically reorder
o Reassemble email message data
6. Back to original format
7. Handed to receiving email application
Functional Relationship:

• Between layers supporting Internet

• Why called TCP/IP stack

Application Layer

Function: Support needs of technology users

Enables Application Development:

• Transport layer handles transmission details

• Opens tremendous potential for applications

Examples:

• Send email from laptop

• Text message to friends from smartphone
• Requires specialized application

TCP Ensures: Data reliably sent across Internet

Common Application Layer Protocols:

Protocol Function
HTTP (Hypertext Transfer Protocol) World Wide Web webpage communication
SMTP (Simple Mail Transfer Protocol) Send/receive email
FTP (File Transfer Protocol) Communicate and transfer files between computers
SSH (Secure Shell) Send commands between computers
IM (Instant Messaging) Exchange text-based messages

Most Practical Layer:

• Internet users can relate to

• Supports daily personal, professional, academic uses

Usage:

• Smartphone apps
• School assignments
• Supported by Application layer
Networking Support Services

Purpose: Support Internet applications communicating on TCP/IP stack

DHCP (Dynamic Host Configuration Protocol):

Function: Manage IP address assignment on network

• Commonly used in schools, businesses

School Scenario:

1. Turn on device to join network

2. Operating system seeks available network
3. Network allows connection
4. DHCP service assigns IP address
5. Assigned IP address used by device
6. Can operate applications capable of Internet communication

DNS (Domain Name Service):

Function:

• Used by Domain Name System

• Set of databases
• Translates IP addresses to domain names

WHOIS Query:

Image Description: Screenshot of [Link]

website with search bar showing "[Link]"
entered and search button visible.

Purpose:

• Check publicly available databases

• Identify domain owner
• Check DNS records
• Determine IP addresses associated with
domain

Process:

1. Navigate to [Link]
2. Type domain (e.g., [Link])
3. Click search
Results for [Link]:

• Activated: September 29, 1986

• Registered by: University of South Florida IT
• Address: 4202 E. Fowler Avenue, SVC 4010, Tampa, FL 33620 USA
• Useful for investigating domain ownership

DNS Records:

Image Description: Screenshot showing DNS records table with columns for Hostname,
Type, TTL, Priority, Content. Row showing "[Link]" with IP address "[Link]"
and additional DNS information visible.

Example:

• [Link] responds to Internet requests

• Assigned IP address: [Link]
• If navigate to [Link] → actually navigating to [Link]
• DNS translates IP to domain name
• Humans easily remember [Link]
• Don't need to remember [Link]

Career Opportunities:

IT Professionals:
 • Support, manage, implement these services
• Enterprise business environments
• Support people and business processes

Education:

• College degree programs

• Industry certifications
• Entire curriculums developed
• Knowledge and expertise for today and tomorrow

Worthy investment if interested in technology career

Computer Network Security

Background:

• Networks originally designed for communication

• NOT designed considering intentional harm risks
• Cybersecurity attacks possible

Cyber-Attack Definition:

• Attempt by malicious person/program

• Damage or destroy computer network
• And systems supporting it

Reality:

• Daily attacks on homes, schools, businesses

• Protecting networks: Necessity in today's world

Firewall:

Function:

• Computer positioned between internal network and outside world

• Monitors incoming network traffic
• Applies filters
• Blocks unwanted/malicious packets

Configuration:

• IT professionals configure filters

• Assign rules
• Identify known harmful traffic
Importance:

• Keeps us safe on Internet

• Malicious people always trying to bypass
• Cybersecurity professionals in high demand

Security Practices:

1. Patching Systems:

• Keep software/OS updated

• Install latest security updates
• Vendors discover weaknesses
• May expose vulnerabilities
• Patches prevent attacks

2. Encryption:

Definition: Scramble data into secret encoded message

• Only unlocked with unique, guarded key

Digital Certificates:

• Issued by certificate authorities

• Encrypt data transmitted over network
• Email, text, instant messages

Simple Encryption Example:

Message: "hello"

Algorithm: Swap each letter with opposite alphabet position

• 'a' ↔ 'z'
• 'b' ↔ 'y'
• etc.

Encrypted: "svool"

Decryption:

• Receiver needs key (algorithm)

• Knows how letters scrambled
• Executes swap in reverse
• Translates "svool" → "hello"
Important Note:

• Simple example for understanding

• In practice: Could be leaked online
• Malicious people could decrypt easily
• Must use strong, complex algorithms
• Impractical for anyone to decrypt

Chapter 16: Cybersecurity

Overview - What is Cybersecurity?

NIST Definition:

Prevention of damage to, protection of, and restoration of computers, electronic

communications systems, services, wire and electronic communication, including
information, to ensure availability, integrity, authentication, confidentiality, and
nonrepudiation.

Core Focus:

• Protect information
• Protect systems managing information

U.S. Law (44 USC 3552):

Protecting information and information systems from unauthorized access, use, disclosure,
disruption, modification, or destruction to provide integrity, confidentiality, and availability.

The CIA Triad

Definition: Core of cybersecurity practice

• C = Confidentiality
• I = Integrity
• A = Availability

Key Point: All about information and systems supporting its management

Current Threat:

• Information and systems under attack

• Powerful adversaries
• Want to steal information for profit
Importance: Understanding cybersecurity protects:

• People
• Resources
• Societies

Journey:

• Explore past (how we arrived at present)

• Study future direction

Confidentiality

Legal Definition (44 USC 3552(b)(3)(B)):

Preserving authorized restrictions on access and disclosure, including protecting personal

privacy and proprietary information.

Right to Privacy:

• Individuals have right

• Extends to information that could cause harm if made public

Custodian Responsibility:

• Organizations holding information

• Must provide privacy
• Must not allow exposure to unauthorized parties

Bank Example:

• People rely on banks

• Protect credit card information privacy
• Expectation: Customer account info not exposed
• Only those requiring access should have it

Modern Cybersecurity Services:

Banks protect customer information privacy:

Fraud Alerts:

• When credit cards used unusually

• Opportunity for customers:
o Freeze credit card
o Cannot be used by violators
Response Process:

1. Freeze compromised card

2. Change credit card information
3. Stolen info no longer useful
4. Dispute all unwanted charges

Integrity

Legal Definition (44 USC 3552(b)(3)(A)):

Guarding against improper information modification or destruction, including ensuring

information non-repudiation and authenticity.

Trust in Information:

• Pull info from system (grades, bank statements)

• Trust information is reliable and actionable

Bank Balance Example:

• Bank reports checking account balance

• Don't calculate totals yourself
• Trust bank made right calculations

Impact of Lost Integrity:

• Imagine if information couldn't be trusted

• Life would be complex
• Integrity prevents this

School Grades Example:

Scenario:

1. Worked hard all semester

2. Expect straight A's
3. Open report card
4. Shows failed all classes!

Devastating Impact:

• Could ruin college chances

• This demonstrates integrity importance

Your Expectation:
 • School grade system maintains integrity
• Rewarded for hard work

Discovery of Violation:

• Must dispute grades

• School investigates
• How was integrity violated?

Without Integrity: Information system not useful for serious work

Availability

Legal Definition (44 USC 3552(b)(3)(C)):

Ensuring timely and reliable access to and use of information.

Simple Example:

• Log into online class

• Expect it to be online
• That's availability

Self-Explanatory Relevance:

• Unavailable system = Not useful system

Virus Impact:

• Most viruses impact availability

• Typically delete important files
• Causes loss of availability

Recovery Time:

• Even if files recovered from backup

• Time lost = Time not doing useful work
• Lack of availability

Facebook Outage - October 4, 2021:

Image Description: Screenshot showing error message indicating Facebook website is
unavailable, demonstrating how websites can be "down" for various reasons ranging from
technical issues to malicious attacks.

Impact:

• Facebook, Instagram, WhatsApp, Oculus unavailable globally

• Period of time offline
• Global disruption of information services
• Affected many people and businesses
• Relied on Facebook infrastructure
Image Description: Screenshot taken October 4, 2021, showing real-time social media
discussions and reactions to the outage, demonstrating how quickly information availability
events become disruptive and cause fear/panic.

Important Note:

• NOT confirmed as cybersecurity attack

• But demonstrated impact:
o How availability affects global information-dependent societies
o Quick disruption possible
o Causes fear and panic

Meta's Official Explanation:

What Happened:

• Command issued during routine maintenance

• Engineer unintentionally took down all backbone connections
• Disconnected Facebook data centers from Internet globally

Why It Took Time:

• Detailed explanation on Facebook Engineering blog

Advertising Impact:

• Ads didn't deliver during offline time

• Advertisers not billed for outage period
• Campaigns experienced volatility when services restored

October 8 Incident:

• Separate configuration change

• Some people/businesses had trouble accessing
• Shorter period
• Teams quickly resolved
• Restored access

Brief History of Cybersecurity Events

Purpose: Understand how cybersecurity functions today

• Know specific past incidents

• How they influenced business environment
• Not comprehensive list
• Excellent examples of security concerns
 • Significant role in establishing laws/organizations

Pattern: New cybersecurity/technology terms gradually introduced into daily lexicon

1981 - TCP and IP Development:

Core Internet Technologies Finalized

• No security mention
• Technology world not concerned about cybersecurity then

Impact:

• TCP and IP available free

• Became preferred networking technology for UNIX
• Widely used: Universities, hospitals, banks

Key Point:

• Without TCP/IP: Probably no networking

• Without networking: Probably little cybersecurity risk

1982-1983 - Gang of 414's:

First Computer Intrusions

• Soon after TCP/IP integrated into industrial equipment

The Group:

• Six teenagers from Milwaukee

• Named for area code 414
• Found it exciting to access restricted systems

Methods:

• Home computers
• Phone lines
• Default passwords

Targets:

• ~60 high-profile systems

• Los Alamos Laboratories
• Memorial Sloan-Kettering Cancer Center (NYC)
Media Coverage:

• Wide coverage
• Newsweek cover: "Beware: Hackers at play"
• First use of "hacker" in mainstream media (computer security context)

Impact:

• Teenagers did no harm themselves

• But techniques easily replicated
• US Congress held hearings
• Computer Fraud and Abuse Act of 1986
• Made crime to break into federal/commercial systems

1988 - Morris Worm:

Robert Morris:

• Then: Graduate student at Cornell

• Now: Professor of CS and AI at MIT

Event:

• November 2, 1988
• Released 99-line self-replicating program
• To measure size of nascent Internet

Unintended Consequences:

• Design feature brought down many infected systems

Landmarks:

• First Internet worm

• Brought down 10% of Internet (largest percentage ever)
• First conviction under 1986 Computer Fraud and Abuse Act

Sentence:

• Probation
• Community service
• Fine

Result:

• US government established CERT/CC

• At Carnegie Mellon University
• Single point to coordinate industry-government response
 • To Internet emergencies

Interesting Note:

• Prof. Morris co-founded Viaweb

• E-commerce firm bought by Yahoo
• Renamed "Yahoo! Store"

Father and Son Story:

Bob Morris (Father):

• Designed password encryption for UNIX

• Still used today
• At time of incident:
o Chief scientist for National Computer Security Center (NCSC)
o At National Security Agency (NSA)
o Federal agency responsible for designing secure computers

Irony: Son's worm while father heading computer security!

1995-1998 - Windows 95/98:

Release:

• August 24, 1995

• Graphical interface
• Designed for inexpensive computers

Success:

• Heavy marketing push

• Became most successful OS ever produced

Design Flaws:

• Primarily stand-alone single user desktop

• Almost no security precautions
• Most users ran without passwords
• Applications ran with administrative privileges (convenience)

But:

• Supported TCP/IP
• Brought TCP/IP into mainstream businesses
Result:

• Security-agnostic networking (TCP/IP)

• Security-agnostic desktop (Windows 95)
• Fertile environment for security compromises

Expert Opinion:

• TCP/IP-Windows 95 environment
• Birthplace of information security profession

1996 - HIPAA:

Health Insurance Portability and Accountability Act

Primary Focus:

• Protect health insurance

• Workers changing or losing jobs

Information Security Implications:

Government Belief:

• Electronic Health Records (EHR) important

• Lower rising healthcare costs

Act Provisions:

• Pushed for electronic health records

• Information security getting recognized
• Made organizations responsible
• Maintain confidentiality of patient records

Result:

• Healthcare moved completely to EHR

• Created significant demand
• Information security within healthcare industry

2000 - ILOVEYOU Virus:

Release:

• May 5, 2000
• Created by student in Philippines
Functionality:

• Deleted images on infected computers

• Automatically sent itself as email attachment
• To all Outlook contacts

Impact:

• Infected millions worldwide

• Billions of dollars in damage

Creators:

• Reomel Ramores and Onel de Guzman

• Traced within hours

Legal Issue:

• Philippines had NO law against writing viruses

• All charges dropped

Global Realization:

• Information security is global phenomenon

• Push from developed countries
• Encourage developing countries to revamp laws

Ongoing Challenge:

• Even today: Significant international differences

• US: Up to $250,000 fine + 10 years imprisonment
• Philippines: 100,000 Pesos (~$2,500) + up to 3 years

2002 - Sarbanes-Oxley Act:

Background (2000-2002):

• Many corporate fraud incidents

• Legendary companies involved:
o Enron: $100B revenue 2000 → bankruptcy 2001
o WorldCom: Overstated earnings $72B in 5 quarters

Fraud Mechanism:

• Fraudulent manipulation of accounting systems

• At behest of firm leadership

CEO Defense:
 • Pleaded ignorance of accounting
• Claimed blind trust in lieutenants

Impact on Americans:

• Most retirements invested in publicly traded firms

• Downfalls affect most American families

Congressional Response:

• Enacted Sarbanes-Oxley Act 2002

• Make key executives personally accountable
• For correctness of financial reports

Three Major Provisions:

Section 302:

• CEO and CFO must sign declaration

• Personal knowledge of all information
• In annual filings

Section 906:

• Criminal penalties
• Up to 20 years imprisonment
• For incorrect certification

Section 404:

• Certification based on formal internal controls

• Major impact on information security profession
• Required publicly traded companies
• Establish formal information security processes

Result:

• Significant investments in internal controls

• Over financial reporting
• Growth in demand for cybersecurity professionals

2005-2007 - Retailer Attacks:

[Link] (December 2006):

• Computer systems breached

• Processed credit card payments
• Breach started July 2005 (18 months before discovery)
 • Over 45 million credit/debit cards stolen

Leader:

• Albert Gonzalez
• Secret Service informer!
• Cooperating on another case during attacks

Other Victims:

• BJ's Wholesale Club

• DSW
• OfficeMax
• Boston Market
• Barnes & Noble
• Sports Authority

Modus Operandi:

• Drive along US Route 1 in Miami

• Seek insecure stores with wireless networks
• Enter corporate networks

Later Improvement:

• SQL injection attacks

• Hannaford Brothers
• Heartland Payment Systems (credit card processor)
o 125 million cards stolen
o $12M+ damages

Sentence (March 2010):

• 20 years prison
• Forfeited $1.65M (from selling fake cards)

Impact:

• Large firms had glaring weaknesses

• Could lead to serious embarrassment/losses
• SQL injection attacks created awareness
• Need attention to security during software development
• Introduced "secure SDLC" to IT lexicon

2008 - Georgia DDoS Attacks:

Timing:
 • Coincided with Georgia-Russia military war

Attack:

• Massive distributed denial of service

• Defaced websites
• Many media and government organizations
• Limited ability to communicate about war

Belief:

• Cyber-attacks caused by Russia

• Part of war strategy
• First known incidents of cyber-attacks as warfare instrument

June 2009 - US Cyber Command Established:

April 2009 Events:

F-35 Lightning II Breach:

• Wall Street Journal reported

• Intruders broke into defense contractor networks
• $300 billion project
• Defense Department's costliest weapons program
• 7.5 million lines of code
• Terabytes of data stolen
• Aircraft design and electronics
• Would help enemies plan defenses
• Contractors: Lockheed Martin, Northrop Grumman, BAE Systems

US Electricity Grid Penetration:

• Also April
• Spies from China, Russia, others
• Inserted software into grid
• Could cause damage by remote control

Response:

• June 23, 2009

• US Cyber Command created
• Defend US military computer networks
• Respond to cyber attacks

2010 - Operation Aurora / Google-China:

January 12, 2010:

• Google Chief Legal Officer blog post

• Detected attack attempt from China
• Steal intellectual property

Additional Targets:

• Emails of Chinese human rights activists

US Government Response:

• Congress announced investigation

• Secretary of State compared to "information-age Berlin Wall"

Investigation:

• Traced to two Chinese educational institutions:

o Shanghai Jiaotong University (elite CS program)
o Lanxiang Vocational School (trains CS for military)

China's Response:

• Denied formal government involvement

• Called it students refining computer skills

Significance:

• One of earliest suspected state-sponsored cybersecurity incidents

April 17, 2011 - Sony PlayStation Network:

Announcement:

• Just before summer break 2011

• External intrusion compromised PSN and Qriocity
• Hackers obtained personal information
• 70 million subscribers affected

Response:

• Company took network offline

• Remove all traces of offending software

Impact:

• Millions of kids worldwide

• Planned summer breaks around online gaming
 • Had to find alternate ways to pass time

Perspective:

• Relatively innocuous network affected

• But huge impact on families worldwide
• Almost every family with kids followed developments

Imagine: Losing entire summer break to cybersecurity incident

• Actually happened summer 2011

February 1, 2013 - Mandiant APT1 Report:

Report Released:

• Cybersecurity firm Mandiant

• Alleged Chinese military unit 61398
• Engaged in state-sponsored attack

APT (Advanced Persistent Threat):

• Sophisticated and well-resourced adversary

• Multiple attack methods
• Over extended period
• Execute objectives

Mandiant Called It: APT1

Impact:

• Considerable attention
• Business and government leaders realized:
o Cyber-attacks no longer limited to individuals
o No longer just private gain
o States could invest military-scale resources
o To compromise cybersecurity

2014 - Yahoo Cyber-Attack:

Scale: 500 million accounts stolen

Perpetrators:

• State-sponsored actors (believed)

• Cybercriminals hired by Russian agents
Data Stolen:

• Email addresses
• Passwords
• Telephone numbers
• Dates of birth
• Names

Method - Phishing Campaign:

• Form of social engineering

• Targeted Yahoo employees with network access
• Employee clicked malicious link in email
• Allowed hackers continuous network access

Vulnerability:

• Security questions and answers

• Stored unencrypted by Yahoo

Evolution:

• Social engineering attacks progressively sophisticated

• Since early 2000s

Significance:

• One of most significant attacks to date

Today:

• US CISA publishes security tips

• How to avoid social engineering and phishing

2021 - RockYou2021:

Event:

• Hacker (identity undisclosed)

• Harvested billions of user passwords

Scale:

• Largest password collection ever leaked online

• 100GB TXT file
• ~8.4 billion password entries
• Could cover entire global online population several times over
Current Use:

• [Link] file used by:

o Cybersecurity researchers
o Cybersecurity professionals
• As wordlist to study/recreate brute force attacks

Brute Force Attack:

• Programming script
• Repeatedly executes code
• Attempting to log into system
• With user account

Distribution:

• Managed in software packages

• Open-source Linux distributions
• Example: Kali Linux
• Designed for cybersecurity professionals
• Assess security of systems

Evolution Summary:

Attack Evolution:

• Technical proofs-of-concept
• → Commercially driven (steal credit cards)
• → Government-sponsored (pursue agendas)

Example - Romania:

• Remote town: Râmnicu Vâlcea

• Cyber money laundering focal point
• Mercedes dealerships in middle of nowhere

Social Response Evolution:

• Judges warning intruders

• Laws making exceptions for juveniles
• → Governments establishing military commands
• To deal with cybersecurity

The Basic Information Security Model

Purpose:
 • Organize all information security activities
• Into unified model
• Provide structure to efforts

Why Needed:

• Information security = very broad subject

• Most incidents exploit new weaknesses
• Requires attention to almost every organizational aspect

Model Use:

• Represent concept existing in real world

• Makes easy to understand cybersecurity event motivations

Image Description: Circular diagram showing:

• Center: "IT System" with "Vulnerabilities" labeled inside

• Protective ring around center labeled "Controls"
• Multiple arrows of varying widths labeled "Threats" pointing at system from outside
• Some arrows blocked by controls ring
 • One arrow penetrating controls but not reaching center
• Arrow width represents relative threat frequencies

Framework Components:

• Illustrates relationship between:

o Assets (center)
o Vulnerabilities
o Threats (arrows)
o Controls (protective ring)

Four Core Components:

• Extremely important to understand

• Any cybersecurity event or case
• Where information is target

Assets

Definition: Resource or information to be protected

Security Scenario Basics:

• All security scenarios start with asset

• Asset valuable enough for special protection efforts
• Information security no different

Value Principle:

• If information/resource valuable to organization

• Organization must put forth special effort to secure it

Two Important Differences:

Information Assets vs. Conventional Assets:

1. Invisibility:

Conventional Assets:

• Can be seen and felt

• Examples: Cars, homes
• Lock cars prevent theft
• Home alarms prevent break-ins
• Assets visible to naked eye
• Damage visible
 • Break-in immediately visible
• Cameras capture vandalism

Information Assets:

• NOT tangible artifacts

• Data and information as 0s and 1s
• Stored on computers, tapes, phones, devices
• Hard drives visible
• But valuable data stored = invisible
• Data stolen over network = transfer not visible
• Not visible to cameras
• Not visible to conventional security
• Thieves may operate from another country
• Thousands of miles away
• Safe from conventional security scrutiny

2. Duplicability:

Conventional Assets:

• Car stolen → Notice missing car in morning

• Car can only exist in one place at time

Information Assets:

• Information can be duplicated

• Data stolen → Won't notice until brought to attention

Example:

• Someone finds laptop unattended

• Emails copy of assignment to themselves
• Submits copied assignment as own work
• No idea of plagiarism act
• Unless instructor brings to attention

Implications for Information Security:

Different Challenge:

• Than conventional security

• Conventional methods (locks, guards) not very effective

Examples:
 • Locks do little to prevent network data theft
• Stolen conventional asset (gold) can be recovered
• But stolen data:
o May be copied to 100 locations
o Even if some copies destroyed
o Almost impossible to deny thief access

Information Security Must:

• Prevent theft in first place

• Detect and block thefts as they occur
• Through constant monitoring

IT Assets:

Most Common Scenario:

• Information assets stored in IT system

• Paper-based systems can't provide density needed

IT System Definition:

• Assembly of computer hardware, software, firmware

• Configured for:
o Processing information
o Storing information
o Forwarding information

Example: Small family-owned business

• May be as simple as Excel spreadsheet

Threats

Definition:

• Capabilities, intentions, and attack methods

• Of adversaries
• To exploit or cause harm to assets

Example:

• Excel file without password protection

• Worker wants to exploit lack of protection
• Modify their hourly rate
Framework Representation:

• Shown as arrows in Figure 250

MITRE ATT&CK Framework:

Mitre Organization:

• Non-profit
• Federally funded
• Research and development organization

Framework Includes:

• Real-world observations
• Globally accessible knowledge inventory
• Tactics and techniques
• Used by cybercriminals
• To exploit IT system vulnerabilities

Tremendous Source:

• Threat Intelligence

Threat Intelligence:

NIST Definition:

Threat information that has been aggregated, transformed, analysed, interpreted, or enriched
to provide necessary context for decision-making processes.

Availability:

• Public and private resources

• For cybersecurity professionals
• Collection of information necessary
• Understand global threats
• Actively seeking to exploit vulnerabilities
Image Description: Screenshot from MITRE ATT&CK website showing phishing technique
page (T1566) listing groups:

• Axiom: Description and associated techniques

• GOLD SOUTHFIELD: Description and techniques
• Hikit: Description and techniques
• Table format with multiple columns of threat information

Example Threats:

Axiom:

• Suspected Chinese cyber espionage group

GOLD SOUTHFIELD:

• Motivated for financial gain

Both:

• Considered global threats to cybersecurity

Hikit:

• Classified as malware
• Used to remotely connect to IT system
• Purpose: Create persistent threat
• Cause damage at any time malicious actor chooses

Popular Threat Types:

1. Viruses:

• Computer programs
• Adversely affect computers
• Propagate through network
• Without user consent
• Uses other programs to spread (e.g., email client)
• Requires user action

2. Worms:

• Computer programs
• Adversely affect computers
• Propagate through network
• Without user consent
• Can propagate independently (self-spreading)
• Doesn't need other programs
Modern Reality:

• Authors know most users have antivirus

• Designed to cause maximum damage quickly
• Within minutes of release

3. Phishing:

• Attempt to compromise user

• Masquerading as trustworthy entity
• In electronic communication

Early Attacks:

• Acquire: Usernames, passwords, credit card details

Common Experience:

• Most people receive 1-2 phishing emails weekly

Method:

• Emails appear from banks

• Lead to fake website
• Looks like bank's website
• Ask for username/password
• "Make some correction at bank"

Reality:

• Emails and websites NOT legitimate

• Careful URL examination reveals:
o Website hosted at compromised server

Risk: Users can easily fall victim

4. Malware (Malicious Software):

General Term:

• Software/code specifically designed to exploit

• Computer or data it contains
• Without user consent

Common Delivery Method:

 • Via free downloads
• Author creates seemingly useful software
• Distributes for free
• Unsuspecting users download and install
• Malware installed along with it

Called: Trojan Horse technique

Vulnerabilities

Why Information Security Important:

• All systems have vulnerabilities

Definition:

• Weakness in information system

• Gives threat opportunity to compromise asset

Relationship:

• Vulnerability of asset enables threats

Excel Example Vulnerabilities:

• Unauthorized access → Loss of confidentiality or integrity

• Hard drive failures → Loss of availability

Hypothetical Utopia:

• If no vulnerabilities existed
• Wouldn't need to study information security
• Wouldn't need professionals dedicated to it

Reality:

• Modern software products are large

• Example: Microsoft Windows
o Millions of lines of code
• Difficult to anticipate and eliminate all vulnerabilities

CVE List:

Common Vulnerabilities and Exposures

 • Software industry + federal government collaboration
• Invested considerable resources
• Create inventory of known software vulnerabilities

Purpose:

• Provide common names and identifiers

• For all publicly known software vulnerabilities

Maintained By: Mitre

Access: [Link]

Software Vulnerability:

Definition:

• Error in specification, development, or configuration

• Of software
• Such that execution can violate security policy

Example - SQL Injection:

Scenario:

• Software developer creates website

• Requires user input in textbox
• Before submitting form

Vulnerability:

• Developer doesn't write code to validate input

• Possible for malicious hacker to:
o Inject SQL into textbox
o When form submitted

Attack Name: SQL Injection attack

Image Description: Screenshot of ChatGPT interface showing:

• User input attempting SQL injection

• ChatGPT response explaining it cannot execute malicious code
• Demonstrates input validation working correctly to prevent software vulnerabilities

ChatGPT Example:

What It Is:

• Free Artificial Intelligence (AI) website

• By OpenAI
• Allows user to enter text in textbox

How It Works:

• Analyzes text
• Attempts to respond using AI
• Similar to how human answers verbal query

Security Demonstration:

• User attempts to inject malicious SQL

• ChatGPT does NOT allow code to execute
• Illustrates how developers:
o Written code validating user input
o Prevent software vulnerabilities of IT system

Controls

Reality:

• All IT systems vulnerable for foreseeable future

• Dedicated attackers will threaten to exploit
• For personal gain or other motives

Question: What does system administrator do?

Answer: Deploy security controls

Definition:

• Safeguards used to minimize impact of threats

Framework Representation:

• Shown as ring around IT system (Figure 250)

Arrow Width Meaning:

• Indicates relative frequencies

• Of different threat categories
• Seen by typical organization

Common Organizational Controls:

Most Threats Blocked By:

• Controls commonly adopted

Examples:

• Firewalls: Come with default settings

• Passwords: Encourage strong passwords for admin accounts
• Backups: Important files on external storage/Internet services
• Physical Locks: Keep computers locked prevent unauthorized access

Effectiveness:

• Rudimentary controls
• Successfully block large majority of threats

Control Weaknesses:

Even Best Security Controls Have Holes:

User Behavior Examples:

• Prefer memorable passwords over secure passwords

• Irregular data backup
• Even after spending hundreds/thousands on backup systems
Threat Exploitation:

• Exploit these weaknesses

• Reach vulnerable IT systems

Figure 250 Representation:

• Arrow on right breached controls

• Reached IT system

Silver Lining:

• Many threats may yet do no harm

• Shown by arrow's inability to reach IT system

Three Types of Cybersecurity Controls:

1. Physical Controls:

• Use traditional non-technical methods

• Prevent harm
• Typically prevent unauthorized facility entry

Examples:

• Locks
• Fire extinguishers
• Background checks
• Doors

2. Procedural Controls:

• Prescribed plans of action

• Govern use of computer resources

Examples:

• Procedures for obtaining computer accounts

• Procedures for escalating privileges
• Procedures for modifying programs
• Procedures for hiring
• Requirements: Users change passwords periodically

3. Technical Controls:
 • Security measures built into information system

Examples:

• Passwords
• Firewalls
• Intrusion detection systems
• System updates
• Antivirus software

Cyber Hygiene

CISA Definition:

• Practices that reduce risk

• Of successful cyber-attack

Importance:

• People must understand good practices

• To safely use online IT systems and resources

Intuitive Practices:

1. Update Security of Technical Devices:

Example:

• Mobile device has software update

• Displays alert on screen

User Choice:

• Ignore updates OR
• Download and install

Best Practice:

• Keep mobile device up to date

• Excellent cyber hygiene
• Prevent cybercriminals from causing harm

2. End-Point Protection:
Formerly Called: Antivirus software

Example: McAfee

Purpose:

• Protect identity, privacy, devices

How:

• Software products monitor devices

• For known viruses
• Other malicious technologies
• Intent to harm user

3. Password Management:

One of Most Effective Practices

Keeping Passwords Safe and Secure:

• ✓ Avoid same password for multiple accounts

• ✓ Change passwords regularly
• ✓ At least 12+ characters long
• ✓ Mixture: Upper/lowercase + symbols + numbers
• ✗ Avoid obvious (sequential like 1234)
• ✗ Avoid personal info (pet names, first car)
• ✗ Avoid sharing with others
• ✓ Use password manager (e.g., 1Password)
• ✓ Multi-factor authentication
o Login username/password
o Plus code sent as text

4. Data Protection:

• ✓ Back up important files securely

o External hard drive
o Cloud storage
• ✗ Don't post private info on social media
o Home address
o Phone number
• ✓ Check social media privacy settings
o Each platform slightly different
• ✓ Keep devices locked when not in use
 o Password or PIN

5. Network Security:

• ✗ Don't use public Wi-Fi for private transactions

• ✓ Only make transactions on secure websites
o Requires https:// (not just [Link]
• ✓ Change default home Wi-Fi router name
• ✓ Setup guest network on home Wi-Fi
o For guests instead of personal network
• ✓ Use firewalls
o Prevent malicious software accessing network
• ✓ Encrypt devices with sensitive data
o Example: Removable USB drives

6. Device Disposal:

• ✓ Before selling/disposing of device

• ✓ Good practice: Wipe hard drive clean

People = Weakest Link:

Reality:

• Many cyber-attacks exploit people's vulnerabilities

• Exploit poor cyber hygiene

Social Engineering:

• Used by malicious actors

• Intent: Get people to expose specific information
• Information they'd otherwise be unwilling to share

Consequences:

• Exposed information can be used against person

• Horrible things possible:
o Stealing identity
o Emptying bank accounts

Ongoing Necessity:

• As technologies evolve
 • General population must stay informed
• What it takes to practice good cyber hygiene

Teams in Cybersecurity

Team Role:

• Professionals work in teams

• Respond to or investigate cybersecurity events

Must Be Familiar With:

• TTPs (Tactics, Techniques, Procedures)

• Used by bad actors in cybersecurity events

TTP Definitions:

Tactics:

• Basic methods used by hacker

• To gain access to system or information

Techniques:

• Tools or methods used by hacker

• To gain access to system or information

Procedures:

• How hacker carries out techniques

• Step-by-step

Behavioral Understanding:

Teams Need:

• Familiarity with TTPs

• Known by cybersecurity intelligence community
• Understand hacker behavior

Purpose:

• Better protect companies and systems

• From being attacked
Largest Open-Source Repository:

• MITRE ATT&CK framework

• TTP knowledge
• Used by cybersecurity teams
• Real-world threat intelligence
• Help make world safer

Hacker Classifications:

Not All Hackers Are Bad:

Common Misunderstanding:

• People call bad actors "malicious hackers"

Reality:

• Cybersecurity teams specialized in different areas

• Behavior commonly engaged by hackers
• Team members could also be called hackers

Classification:

• By intent of behavior
• Whether bad or good intentions
• Teams must understand ALL classifications

Two Common Team Types:

Red Teams:

Description:

• Cybersecurity teams
• Operators use tools and techniques
• Typically used by malicious actors
• Attack system or information it manages

Sports Analogy:

• Think of as "offense"

Attacks Called:

• Campaigns
Intent:

• Help companies understand:

o How security weaknesses exploited
o By malicious actor

Benefit:

• Company can implement:

o Better business practices
o Better technology practices
o Protect systems from future attacks

Blue Teams:

Description:

• Focus on constant defense

• Of systems and information
• Managed by organizations

Common Practice:

• Companies work with SOC

• Security Operation Centers
• Multiple Blue Teams
• Dedicated to watching systems
• Critical to daily business

Training:

• Tools designed to:

o Protect
o Capture
o Analyze
o Respond to cybersecurity event

Response Process:

1. System attacked (malicious actor or malware)

2. Blue Team investigates
3. Understand what happened
4. Understand how it happened
5. Recommend mitigating response
6. Prevent event from happening again
Team Sport Concept:

Overall:

• Consider cybersecurity as "team sport"

Requires:

• Teams of individuals working together

• Endless understanding:
o Offensive TTPs
o Defensive TTPs
o Used by hackers globally

Motivation:

• "Good" hackers
• Passionate about preventing "bad" hackers
• From harming:
o Security of information
o Management of critical systems

Image Description: Illustration showing HR department layout with:

• Two operators (Hatter and Bee) at different positions

• Workstations with computers visible
 • HR desk clerk position marked
• Arrows showing movement and actions
• Labels indicating:
o USB drive insertion
o Malicious program execution
o C2 communication paths

Red Team Case:

• Demonstrates operation on HR department

• Exploiting physical and technical vulnerabilities
• Gaining unauthorized persistent access
• To company network