Information Security

Encryption
Chapter 3

Dr. Liaquat Ali Thebo

Corporate Computer and Network Security by Raymond

Panko, Prentice Hall, Latest Edition.

CISSP, Shon Harris, McGraw-Hill Osborne Media, Latest

Edition

Cryptography and Network Security, William Stallings,

Prentice Hall, Latest Edition
 End to End vs Link to Link Encryption
• This is classic Alice and Bob problem: Alice
wants to send Bob a secure message. What
does she do? She encrypts the message.
• In theory, this encryption can take place at any
layer in the OSI (Open Systems
interconnection) communication model.
• In practice, it takes place either at the lowest
layers (one and two) or at higher layers.

2
 End to End vs Link to Link Encryption
• If it takes place at the lowest layers, it is called
Link-by-Link encryption;
• everything going through a particular data link
is encrypted.
• If it takes place at higher layers, it is called
End-to-End encryption;
• the data are encrypted selectively and stay
encrypted until they are decrypted by the
intended final recipient.
3
 End to End vs Link to Link Encryption
• Link-by-Link Encryption
• Encryption is added at the physical layer
• called link-by-link encryption
• The interfaces to the physical layer are
generally standardized and it is easy to
connect hardware encryption device at this
point.

4
 End to End vs Link to Link Encryption
• Link-by-Link Encryption
• These devices encrypt all data passing through them,
including
• data routing information, and
• protocol information.
• They can be used on any type of digital communication
link.
• On the other hand, any intelligent switching or storing
nodes between the sender and the receiver need to
decrypt the data stream before processing it.

5
 End to End vs Link to Link Encryption
• Link-by-Link Encryption
• very effective encryption
• everything is encrypted
• a cryptanalyst can get no information about the
structure of information
• This is called traffic-flow security
• Key management is also simple; only the two
endpoints of the line need a common key and
they can change their key independently from the
rest of the network.

6
 End to End vs Link to Link Encryption
• Link-by-Link Encryption
• The biggest problem with encryption at the
physical layer is that each physical link in the
network needs to be encrypted. Leaving any
link unencrypted jeopardizes the security of
the entire network.
• Additionally, every node in the network must
be protected, since it processses unencrypted
data.

7
 End to End vs Link to Link Encryption
• Link-by-Link Encryption
• Advantages
• Easier operation, since it can be made
transparent to the user. That is, everything is
encrypted before being sent over the link.
• Only one set of keys per link is required.
• Provides traffic-flow security, since any routing
information is encrypted
• Encryption is online

8
 End to End vs Link to Link Encryption
• Link-by-Link Encryption
• Disadvantages
• Data is exposed in the intermediate nodes.

9
 End to End vs Link to Link Encryption
• End-to-End Encryption
• Another approach is to put encryption equipment
between the network layer and the transport
layer.
• The encryption device must understand the data
according to the protocols up to layer three and
encrypt only the transport data units,
• which are then recombined with the unencrypted
routing information and sent to lower layers for
transmission.
10
 End to End vs Link to Link Encryption
• End-to-End Encryption
• This approach avoids the encryption / decryption
problem at the physical layer.
• By providing end-to-end encryption, the data remains
encrypted until it reaches its final destination.
• The primary problem with end-to-end encryption is
that the routing information for the data is not
encrypted;
• a good cryptanalyst can learn much from this
• Key management is also more difficult, since individual
users must make sure they have common keys

11
 End to End vs Link to Link Encryption
• End-to-End Encryption
• The major disadvantage of end-to-end
encryption is that it allows traffic analysis.
Traffic analysis is the analysis of encrypted
messages. A lot of good information is buried
in that data, and a cryptanalyst will want to
get his hands on it.

12
End to End vs Link to Link Encryption
Link-by-Link Encryption End-to-End Encryption
Security within Hosts
Message exposed in sending host Message encrypted in sending host
Message exposed in intermediate nodes Message encrypted in intermediate nodes
Role of User
Applied by sending host Applied by sending process
Invisible to user User applies encryption
Host maintains encryption User must find algorithm
One facility for all users User selects encryption
Can be done in hardware More easily done in software
All or no messages encrypted User chooses to encrypt or not, for each
message
Implementation concerns
Requires one key per host pair Requires one per user pair
Requires encryption hardware or software Requires encryption hardware or software
at each host at each node
Provides node authentication Provides user authentication

13
 Hardware vs Software Encryption
• Hardware
• Until recently, all encryption products were in the
form of specialized hardware.
• These encryption/Decryption boxes plugged into
a communications line and encrypted all the data
going across that line.
• Although software encryption is becoming more
prevalent today, hardware is still the embodiment
of choice for military and serious commercial
applications.
14
 Hardware vs Software Encryption
• Hardware
• The NSA, for example, only authorizes
encryption in hardware. there are several
reasons why this is so.
• Speed (complicated operations on plaintext)
• Inefficient to use processor for Encryption i.e;
computation intensive task
• No physical protection (running on a
generalized computer)
15
 Hardware vs Software Encryption
• Hardware
• Hardware encryption devices can be securely
encapsulated to prevent this
• Dedicated encryption boxes can be shielded,
so that they leak no compromising
information
• Ease of installation (most encryption
applications don’t involve general purpose
computers
16
 Hardware vs Software Encryption
• Hardware
• The three basic kind of encryption hardware on the
market today are:
• Self-contained encryption modules (that perform
functions such a password verification and key
management for banks)
• Dedicated encryption boxes for communications links,
and
• Boards that plug into personal computers
• PC-board encyptors usually encrypt everything written
to the hard disk, floppy disk and serial port as well.

17
 Hardware vs Software Encryption
• Software
• Any encryption algorithm can be implemented
in software
• The disadvantages are in speed, cost, and ease
of modification
• The advantages are in flexibility and
portability, ease of use and upgrade

18
 Hardware vs Software Encryption
• Software
• Software encryption programs are popular
and are available for all major operating
systems.
• These are meant to protect individual files.
(key and encrypted files)
• Many programs are sloppy in this regard, and
user has to choose carefully

19
Hardware vs Software Encryption
Hardware Based Cryptography Software Based Cryptography

1. Uses dedicated hardware, thus 1. uses shared hardware, thus

much faster to execute slower to execute

2. Not dependent on the 2. Dependent on the security

operating system. Supported by levels and features of the
dedicated software to operate the operating system and supported
hardware software

3. Can use factory provisioning 3. No dedicated secure memory

and securely store keys and other locations available. Thus,
data in dedicated secure memory susceptible to stealing or
location manipulation of keys and data.
20
Hardware vs Software Encryption
4. Maxim’s hardware 4. software implementation can be
implementations have protections easier to reverse-engineer.
built in against reverse-engineering,
such as PUF (ChipDNA)
5. in hardware system, special care 5. in a general-purpose system
is taken to hide and protect the vital where software cryptography is
information, such as private keys, to implemented, there are more ways
make it much more difficult to to snoop to and access vital
access. information. An example would be
intercepting the private key in
transit within the computer’s
system.

21
 E-Mail Standards
• INTRODUCTION
• Now, virtually all businesses use email for important
communications. And just as it’s always been
extremely important to safeguard physical mail, many
types of email encryption for security purposes have
become vital for all businesses.
• The sheer volume of emails sent every day makes
protecting them a key element of any business’s cyber
security. To protect an email’s contents, and the
security of both its senders and recipients, you need
encryption.

22
 E-Mail Standards
• INTRODUCTION
• Email encryption is an amazing innovation
in cyber security. It uses the technology of
cryptography, which adapts it to protect
communications in the digital age. At its
base, cryptography works by generating a
secret code. This code is undecipherable
by a human at least, without the proper
access.

23
 E-Mail Standards
• INTRODUCTION
• Encryption is absolutely essential for keeping your
emails—and company—safe.
• Cyber defense is a complex arena
• The most common and useful forms of email security
fall into three categories:
• Gateway
• Encryption
• Authentication
• Of these three, the biggest and most important part is
encryption.

24
 E-Mail Standards
• INTRODUCTION
• Gateways and authentication are attempts at preventing email from
being stolen.
• But without encryption, any email that is intercepted or otherwise
compromised would become an immediate security hazard.
• With encryption enabled, even stolen mail may not be readable by
the thief.
• Encryption also comes in several different forms, and there are
multiple tools and protocols that can come into play, sometimes
even in combination with each other.
• Encryption is an extremely complex and dynamic field. It has to be,
as it relies upon the inability of humans to crack the codes used for
encryption.

25
 E-Mail Standards
• INTRODUCTION
• Overall, there are actually only two main variants of email
encryption. The two main categories are:
• Transport level encryption – Wherein the emails’ contents
are secured during their transport between sender and
receiver, but not (necessarily) before or after transit. This
form of encryption is slightly less robust, but is also often
more affordable.
• End to end encryption – Wherein the emails’ contents are
safeguarded at the end points. Any outgoing email is
encrypted when it leaves the sender and is then only
unencrypted when the recipient receives the email. This is
the more robust option.

26
 E-Mail Standards
• 5 Different Types of Email Encryption
• 1: STARTTLS
• This is one of the most prolific forms of transport level encryption.
• It uses forms “S” of Transport Layer Security (TLS), which is the
successor to the now deprecated Secure Sockets Layer (SSL)
protocol. Specifically, STARTTLS is an opportunistic TLS command
that can upgrade a plain text connection to a secure, encrypted
one.
• StartTLS is a protocol command used to inform the email server
that the email client wants to upgrade from an insecure connection
to a secure one using TLS or SSL. StartTLS is used with (SMTP)
Simple Mail Transfer Protocol and (IMAP) Internet Message Access
Protocol, while POP3 uses the slightly different command for
encryption, STLS.

27
 E-Mail Standards
• 5 Different Types of Email Encryption
• 1: STARTTLS
• How does it work? The STARTTLS command
requests encryption for messages while they are
in transit, so neither the sender nor recipient (nor
their resources) need take any actions to view the
message’s contents. This is a great way to counter
attacks like passive monitoring, but it can leave
email contents vulnerable to “man in the middle”
attacks.
• To address this vulnerability, there’s
28
 E-Mail Standards
• 5 Different Types of Email Encryption
• 2: DANE or MTA-STS
• There are two countermeasures available to help maximize
the security of STARTTLS and all transport level encryption:
• DNS based Authentication of Named Entities (DANE)
• Message Transfer Agent Strict Transport Security (MTA-STS)
• The first, DANE, is a key component of a (DNSSEC). DANE is
defined for SMTP in RFC 7672. It prevents “STRIPTLS”
(literally a stripping away of TLS by hackers) by enabling a
requirement for sender and recipient to use TLS.

29
 E-Mail Standards
• 5 Different Types of Email Encryption
• 2: DANE or MTA-STS
• The first, DANE, is a key component of a (DNSSEC) Domain Name
System Security Extensions. It prevents “STRIPTLS” (literally a
stripping away of TLS by hackers) by enabling a requirement for
sender and recipient to use TLS.
• The second, MTA-STS, was drafted by a group including some of the
biggest and most widely used email providers in the market. It
functions like DANE, but uses the certificate authority (CA) and trust
on first use (TOFU) systems rather than DNSSEC.
• Most email is protected by STARTTLS or another form of transport
level encryption. But when these measures aren’t enough, strong
end to end options also offer premium protection.

30
 E-Mail Standards
• 5 Different Types of Email Encryption
• 3: Bitmessage
• This protocol has been a major player in encryption since
just after it was first released in November of 2012. Its
original author, Jonathan Warren, based the system’s
overall design on the then-novel cryptocurrency Bitcoin. It
was released under the liberal MIT license.
• Shortly afterward, it experienced a surge in popularity
following 2013’s revelations of US governmental
surveillance of email. Concerned individuals and businesses
sought a simple way to prevent agencies like the National
Security Agency (NSA) from spying on them. Enter
Bitmessage’s revolutionary peer to peer authentication.

31
 E-Mail Standards
• 5 Different Types of Email Encryption
• 3: Bitmessage
• Some qualities of Bitmessage that make it a powerful security tool
include:
• Decentralization
• Hermetic encryption
• Hidden sender and recipient
• Trustless (zero trust) framework
• Proof of Work (POW) requirement
• Bitmessage is extremely useful and popular, but it’s far from the
only end to end encryption option. It’s often best suited for
individuals or smaller businesses rather than bigger companies.

32
 E-Mail Standards
• 5 Different Types of Email Encryption
• 4: GNU Privacy Guard
• Also known as GnuPG or GPG, GNU Privacy Guard is an
intricate hybrid model for encryption. How does it work,
exactly?
• It uses both public key and symmetric key cryptography, for
ease and speed respectively. It works by generating
asymmetric pairs of keys—one for the sender, and one for
the recipient. Public keys may still be exchanged, and
therefore compromised, so it’s important to practice safe
identity protection to avoid a hacker posing as either party
and stealing email contents.

33
 E-Mail Standards
• 5 Different Types of Email Encryption
• 4: GNU Privacy Guard
• GnuPG is notably a free software developed as
part of the GNU Project. As such, it shares the
principles of that overarching framework,
including freedom of use, share, study, and
modification. Also, it’s received a large share of
its funding from the German government. GnuPG
is compliant with the protocols, which also
govern PGP.
34
 E-Mail Standards
• 5 Different Types of Email Encryption
• 5: PGP and S/MIME
• These are two of the most important and widely used
protocols for end to end email encryption—the vast
majority of email clients enable some combination of PGP
and S/MIME.
• PGP stands for “Pretty Good Privacy,” but its reputation far
exceeds its name. PGP was developed by Phil Zimmerman
and first released in 1991. Now, it’s a gold standard for
email encryption worldwide. It works by mobilizing a series
of algorithms to combine hashing, compression, and
cryptography using both symmetric and public keys.

35
 E-Mail Standards
• 5 Different Types of Email Encryption
• 5: PGP and S/MIME
• What does that all mean? The process of encrypting and
decrypting looks like this:
• It starts with a piece of data and a randomly generated key
• The data is encrypted using the random key, locking it away
• The random key is also encrypted with the receiver’s own
public key
• The locked data and encrypted key are now collectively an
encrypted message
• The receiver’s private key unlocks the data, enabling
random key decryption

36
 E-Mail Standards
• 5 Different Types of Email Encryption
• 5: PGP and S/MIME
• PGP is powered by a web of trust concept that establishes the
legitimacy of a public key’s ownership by degrees of separation
between individuals. This is a decentralized model, but there are
also centrally managed public key models available.
• Enter Secure/Multipurpose Internet Mail Extensions, also known as
S/MIME.
• S/MIME requires an individual user to obtain a key directly from a
particular CA, whether internal to the company or public. In this
way, its relationship to PGP is similar to that of MTA-STS to DANE:
it’s essentially the same functionality, just using a different
paradigm.

37
 Internet Security
• Overview of Computer and Internet Security
• What is Computer and Internet Security
• Who Should be Concerned
• Why Should I Care
• General Security Tips

38
 Internet Security
• Computer Security
• Protecting computers, information, and services
from unauthorized access, change or destruction.
• Internet security extends this concept to systems
that are connected to the Internet
• Browsing the Internet
• Electronic Commerce
• Social Networking
• Emailing

39
 Internet Security
• Who Should be concerned
• Anyone who uses
• Computers
• Mobile Devices
• The Internet
• Email
• Social Networks

40
 Internet Security
• Why Should I Care?
• Infections from viruses, spyware, or malware
• Virus - Program designed to infect your computer,
replicates itself , and usually causes lost or
corrupt data
• Spyware is kind of malicious code that tracks your
habits on the internet without you knowing it;
• Usually collects personal information

• Phishing, Hoaxes, Malware, Scams and Spam

41
 Internet Security
• The most prevalent and persistent threats to your
security come to you in your Inbox. They come by
different names and may even appear legitimate and
even supposedly from people you may know.
• They all have this in common: they are designed to get
you to click on an item like an attachment, link or
picture.
• Broken device
• Devices that do not work when needed or as expected.
• Privacy and personal security concerns
• Preventing private, personal, or sensitive information
from being disclosed
42
 Internet Security
• Basic Approaches to Security
• Use anti-virus and anti-spyware Software
• Detects and removes viruses and spyware from
your computer
• Must be kept up to date
• Install security patches
• Enable Firewalls
• Protects computers by preventing unauthorized
access

43
 Internet Security
• Basic Approaches to Security
• Use strong passwords to protect computers
• Be cautious about downloading free software or
files from untrusted sites
• Most prevalent threats to your security come to
you in your Inbox; are all designed to get you to
click on an item like an attachment, link or
picture.
• If you click, you could launch harmful programs
or be directed to a harmful web site.

44
 Internet Security
• Basic Approaches to Security
• Think before you click on links
• Most threats are targeted in hopes that you will click
on a harmful link, attachment, picture, video or icon in
an email or web page
• Stop: Do not automatically click on Internet links until
you have confidence in them.
• Think: Look at the actual address for the links in
question. For instance if the link indicates “Click Here”
be sure to hover your mouse pointer over the link and
investigate before you proceed.
• Click: Only after you are confident that the site is safe.
45
 Enterprise Network Architecture
• General Characteristics
• Distributed computing
• Component-based applications
• Event-driven systems
• Loose coupling of business functions
• Decision support systems
• Workflow management

46
 Enterprise Network Architecture
• Distributed systems
• Scalability: it should be possible to accommodate
increased number of user, increased number of
transactions, or expand the scope of
functionality.
• It should be possible to add servers, and sites
without any major changes to the basic design of
the architecture or applications.
• It should accommodate diverse computing
platforms with proper use of interoperability
standards and middelware.
47
 Enterprise Network Architecture
• Component-based applications
• Should support component-based applications.
• Components are sharable, replaceable building
blocks.
• This is essential to be able to adapt quickly to the
changing business needs and technology
opportunities.
• Sun’s Enterprise Java Beans (EJB), CORBA
component model (CCM) and Microsoft’s COM+.

48
 Enterprise Network Architecture
• Event-driven process
• Businesses are driven by events: an order is
placed, a shipment is received, a machine fails, a
person is hired.
• Processes must be streamlined.
• When a problem requiring management
attention occurs in production, appropriate
manager should be notified immediately. This
requires a change in the design of systems and
the way they interoperate.
49
 Enterprise Network Architecture
• Loose coupling
• Traditional: large, monolithic solutions.
• Desired: highly coherent focused solutions linked
through the transfer of transactions in an
asynchronous mode of communication.
• Messages queues are used for comm.
• Loose coupling allows for independently
developed applications to interact without
concern about time, internal information format,
and technology.

50
 Enterprise Network Architecture
• Decision Support Systems
• Enterprise integration architecture must support
decision makers with these information:
• Current status
• Exceptions (system and business-based)
• Historical records
• Relevant knowledge
• Currently business exceptions (what we call
incidents in project1) are not recognized by
systems, but rather by humans.

51
 Enterprise Network Architecture
• Business Exceptions
• Events requiring human intervention, shifts in
key business indicators, violations of policies,
or deviations in variables that exceed defined
limits should be treated as business
exceptions.
• Automated business processes and rules
should determine immediately who should
take action and with what priority.

52
 Enterprise Network Architecture
• Business Process Automation
• Traditionally: documents were source of input and
reports were produced as outputs.
• Current business involve interactions between humans
as well as humans and computers.
• Business process automation: workflow management
post a “work list” to a person or application.
• Delays can be monitored, action item can be brought
to attention based on a priority.
• Controls can be applied to make to sure exceptions are
given proper attention and actions receive proper
authorization.
53
 Enterprise Network Architecture
• Workflow Process Model
• Business processes drive the operation of a
business.
• Examples: (enterprise level) fill customer
order, get (trivial) approval on a form.
• Workflow: process definition, process system,
activity, requester, personal work list, resource
assignment facility, process manager, process
interoperability.
54
 Enterprise Network Architecture
• Enterprise Scenario
• Customer, sales portal, customer
representative, billing service, order
processing, customer relationship manager,
accounting, archives, management
information, exceptions, purchasing,
warehouse, supplier, carrier, shipping, carrier..
Back to customer.

55
 Enterprise Network Architecture
• Summary
• Enterprise systems: processes, applications,
application components, messaging,
exceptions and notification, workflow model.

56
 Enterprise Network Architecture
• Hierarchical LAN Design Model
• 3 Layer Design
• Access layer - Gives endpoints and
users direct access to the network.
• Distribution layer - Provides an
aggregation point for the access
layer and acts as a services and
control boundary between the
access layer and the core layer.
• Core layer (also referred to as the
backbone) - Provides connections
between distribution layers for
large environments.

57
 Enterprise Network Architecture
• Scalable Layer Design
• The number of layers needed depends on the
characteristics of the network deployment site.
As illustrated in Figure, a small campus in a single
building might require only access and
distribution layers, while a campus that spans
multiple buildings will most likely require all three
layers. The modularity of this design ensures that
each layer will provide the same services and the
same design methods.

58
Enterprise Network Architecture

59
 Enterprise Network Architecture
• Access Layer
• The access layer, also
commonly referred as
the network edge, is
where end user devices
or endpoints connect to
the network.
• It provides high-
bandwidth device
connectivity using wired
and wireless access
technologies such as
Gigabit Ethernet and
802.11n and 802.11ac
wireless.

60
 Enterprise Network Architecture
• Access Layer
• It can be segmented (for example, by using VLANs) so that different
devices can be placed into different logical networks for
performance, management, and security reasons.
• In the hierarchical LAN design, the access layer switches are not
interconnected to each other. Communication between endpoints
on different access layer switches occurs through the distribution
layer.
• It plays a big role in ensuring that the network is protected from
malicious attacks. This protection includes making sure the end
users and endpoints connecting to the network are prevented from
accessing services for which they are not authorized.
• Quality of service (QoS) trust boundary and QoS mechanisms are
typically enabled on this layer to ensure that QoS is provided end-
to-end to satisfy the end user’s quality of experience (QoE).

61
 Enterprise Network Architecture
• Distribution Layer
• The primary function of the distribution layer is to aggregate access
layer switches in a given building or campus.
• The distribution layer provides a boundary between the Layer 2
domain of the access layer and the core’s Layer 3 domain.
• This boundary provides two key functions for the LAN:
– On the Layer 2 side, the distribution layer creates a boundary for
Spanning Tree Protocol (STP), limiting propagation of Layer 2 faults.
– On the Layer 3 side, the distribution layer provides a logical point to
summarize IP routing information when it enters the core of the
network.
– The summarization reduces IP routing tables for easier
troubleshooting and reduces protocol overhead for faster recovery
from failures.

62
 Enterprise Network Architecture
• Distribution Layer
• The distribution switches need to be deployed in
pairs for redundancy as displayed in Figure.
• The distribution layer switch pairs should be
interconnected to each other using either a Layer
2 or Layer 3 link.
• When campus buildings are geographically
dispersed, distribution layer switches can be
located within the buildings in order to reduce
the number of fiber-optic runs (which are costly)
between buildings.
63
Enterprise Network Architecture

64
 Enterprise Network Architecture
• Core Layer
• As networks grow beyond three distribution layers in a single
location, organizations should consider using a core layer to
optimize the design.
• The core layer is the backbone and aggregation point for multiple
networks and provides scalability, high availability, and fast
convergence to the network.
• The core can provide high-speed connectivity for large enterprises
with multiple campus networks distributed worldwide, and it can
• also provide interconnectivity between the end-user/endpoint
campus access layer and other network blocks, such as the data
center, the private cloud, the public cloud, the WAN, the internet
edge, and network services.

65
Enterprise Network Architecture

Core Layer Reduces Large Network Complexity 66

 Enterprise Network Architecture
• Options
• Two-tier design (collapsed core)
• A collapsed core architecture takes the normal three-tier
hierarchical network and collapses it into a two-tier network. In a
two-tier network, the function of the switches in the core layer
and distribution layer are “collapsed” into a combined core and
distribution layer on a single switch.
• Three-tier design
• Layer 2 access layer (STP based-Spanning tree protocol)
• Layer 3 access layer (routed access)
• Software-Defined Access (SD-Access-Software-defined
access)

67
 Enterprise Network Architecture
• Two-tier design
• Smaller campus networks may have multiple
departments spread across multiple floors within
a building. In these environments, a core layer
may not be needed, and collapsing the core
function into the distribution layer can be a cost-
effective solution (as no core layer means no core
layer devices) that requires no sacrifice of most of
the benefits of the three-tier hierarchical model.

68
 Enterprise Network Architecture
• Two-tier design
• Prior to selecting a two-tier and distribution
layers, future scale, expansion, and manageability
factors need to be considered.
• Switches at the Core/Distribution layer provide
two separate functions:
• connectivity to the WAN, Data Center, internet,
and network services edge blocks
• LAN aggregation to the end-user access layer
switches

69
 Enterprise Network Architecture
• Two-tier design
• The WAN Edge block connects to remote
data centers, remote branches, or other
campus networks or for connectivity to
cloud providers.
• The Data Center/Server Room block is
where business-critical servers are
placed.
• The Internet Edge block is used for
regular internet access, e-commerce,
connection to remote branches, remote
VPN access and non-dedicated cloud
provider connections.
• The Network Services block is where
devices providing network services
reside, such as wireless LAN controllers
(WLCs).

70
 Enterprise Network Architecture
• Three-Tier Design
Three-tier designs separate the core and distribution layers and are recommended
when more than two pairs of distribution switches are required.
Multiple pairs of distribution switches are typically required for the following
reasons:
• When implementing a network for a large enterprise campus composed of
multiple buildings, where each building requires a dedicated distribution layer.
• When the density of WAN routers, internet edge devices, data center servers,
and network services are growing to the point where they can affect network
performance and throughput.
• When geographic dispersion of the LAN access switches across many buildings
in a larger campus facility would require more fiber-optic interconnects back to
a single collapsed core.

71
 Enterprise Network Architecture
• Three-Tier Design
• In Figure, the building blocks or places in the
network (PINs) are each using the hierarchical
design model.
• Each block is deployed with a pair of
distribution switches connected to the core.
• The hierarchical LAN design is more
appropriate for north–south traffic flows, such
as endpoints communicating with the WAN
edge, data center, Internet, or network
services blocks.
• The data center block is using the newer leaf–
spine design, an alternative to the three tier
design when traffic is predominantly east–
west between servers within the data center.

72
 Enterprise Network Architecture
• Layer 2 Access Layer (STP Based-Spanning tree protocol)
• Traditional LAN designs use a Layer 2 access layer and a Layer 3
distribution layer.
• The distribution layer is the Layer 3 IP gateway for access layer hosts.
• Whenever possible, it is recommended to restrict a VLAN to a single
access layer switch to eliminate topology loops.
• Restricting a VLAN to a single switch provides a loop-free design, but at
the cost of network flexibility because all hosts within a VLAN are
restricted to a single access switch.
• Some organizations require that the same Layer 2 VLAN be extended to
multiple access layer switches to accommodate an application or a
service.
• The looped design causes STP to block links, which reduces the bandwidth
from the rest of the network and can cause slower network convergence.

73
 Enterprise Network Architecture
• Layer 2 Access Layer (STP
Based-Spanning tree
protocol) – Topology
Design

• Figure illustrates a loop-

free topology where a
VLAN is constrained to a
single switch, as well as a
looped topology where a
VLAN spans multiple
access switches.
• The looped design causes
STP to block links.

74
 Enterprise Network Architecture
• Layer 2 Access Layer (STP Based-Spanning tree protocol) – High
Availability
• First-hop redundancy protocols (FHRPs) provide hosts with a
consistent MAC address and gateway IP address for each configured
VLAN. The distribution layer should have a pair of standalone
switches configured with a FHRP.
• Hot Standby Router Protocol (HSRP) and Virtual Router Redundancy
Protocol (VRRP) are the most common first-hop redundancy
protocols.
– The downside to these protocols is that they only allow hosts to send
data out the active FHRP router through a single access uplink.
– This leaves one of the access layer-to-distribution layer uplinks
unutilized unless manual configuration of the distribution layer is
performed.

75
 Enterprise Network Architecture
• Layer 2 Access Layer (STP Based-Spanning tree
protocol) – High Availability
• Gateway Load Balancing Protocol (GLBP)
provides greater uplink utilization for access
layer-to-distribution layer traffic by load
balancing the load from hosts across multiple
uplinks.
– The downside is that it works only on loop-free
topologies.

76
 Enterprise Network Architecture
• Layer 3 Access Layer (Routed Access)
• Routed access is an alternative configuration in which
Layer 3 is extended all the way to the access layer
switches. In this design, access layer switches act as full
Layer 3 routed nodes (providing both Layer 2 and Layer
3 switching), and the access-to distribution Layer 2
uplink trunks are replaced with Layer 3 point-to-point
routed links. Consequently, the Layer 2/Layer 3
demarcation point is moved from the distribution
switch to the access switch, as illustrated in Figure

77
Enterprise Network Architecture

78
 Enterprise Network Architecture
• Layer 3 Access Layer (Routed Access)
• The routed access-to-distribution block design advantages over the Layer
2 access
• layer design:
• No first-hop redundancy protocol required - It eliminates the need for
first-hop redundancy protocols such as HSRP and VRRP.
• No STP required - Because there are no Layer 2 links to block, this design
eliminates the need for STP.
• Increased uplink utilization - Both uplinks from access to distribution can
be used, increasing the effective bandwidth available to the end users and
endpoints connected to the access layer switches.
• Easier troubleshooting - It offers common end-to-end troubleshooting
tools (such as ping and traceroute).
• Faster convergence - It uses fast-converging routing protocols such as
Enhanced Interior Gateway Routing Protocol (EIGRP) and Open Shortest
Path First (OSPF).

79
 Enterprise Network Architecture
• Software-Defined Access (SD-Access) Design
• SD-Access - Industry’s first intent-based networking solution for the
enterprise Built on the principles of the Cisco Digital Network
Architecture (DNA)
• A combination of the campus fabric design and the Digital Network
Architecture Center (Cisco DNA or DNAC).
• Adds fabric capabilities to the enterprise network through
automation
• Provides automated end-to-end segmentation to separate user,
device, and application traffic without requiring a network redesign
• Fabric capabilities provide services such as host mobility and
enhanced security in addition to the normal switching and routing
capabilities.

80
Different Traffic Flows in the Enterprise
• Network Traffic
• Today everything is connected through the
internet – billions of pieces of data are constantly
being transferred to and from our phones,
laptops, smartwatches, and every other device
connected to a network. This unsurmountable
surge of data traverses through cyberspace by
breaking up into smaller “data packets” for the
sake of transmission, then reassembles itself at
its destination. This data movement causes the
phenomena of network traffic.

81
Different Traffic Flows in the Enterprise
• Network Traffic
• Network traffic is the traveling of data through a network.
Different activities and behavior will result in different
types of network traffic activity. There are different
categories into which these traffic levels can be placed:

• Heavy traffic where high amounts of bandwidth are utilized

- these would be extremely active and constant network
traffic routes.
• Interactive traffic where bandwidth prioritization takes
place - resulting in slower responses without web and
application traffic limitations in place.

82
Different Traffic Flows in the Enterprise
• Network Traffic
• Non-real-time traffic refers to bandwidth
consumption mainly during public working
hours – such as HTTP, FTP, and e-mail.
• Latency-sensitive traffic risks slower data
retrieval as the ability of data transfer across
the network is cut down drastically.

83
Different Traffic Flows in the Enterprise
• Network Traffic Analysis - NTA?
• Network traffic analysis (NTA) is an advanced method for the
inspection and breakdown of the data packets that form network
traffic by use of a combination of behavior modeling, machine
learning, and rule-based detection to root out any suspicious
activity. A baseline of normal behavior can be identified through
this analysis and any outliers can be flagged down and isolated as
potential threats.
• While this is mostly used for security purposes, network traffic
analysis can also be used for capacity planning and identifying
surges of network traffic in certain areas.
• This rapid communication of data presents several vulnerabilities
for your company - which leans into why exactly tools for network
traffic analysis solution are necessary.

84
Different Traffic Flows in the Enterprise
• NTA - Network Traffic Analysis Solution?
• Drastic strides (Advances) in technology have
made sure that most companies and people rely
heavily on online networks and the constant
availability of data. Business dealings have
become much easier with the world at our
fingertips. Still, the data we depend on is always
vulnerable to cyber-attacks – especially sensitive
data that could cripple (Challenge) production
and tarnish (Damage) the reputation of a
company.

85
Different Traffic Flows in the Enterprise
• NTA - Network Traffic Analysis Solution?
• Therefore, numerous reasons exist to invest in elite network traffic
analysis tools:

• Increased interest in corporate data: The rise in ransomware and

malware attacks has pushed criminals to target business servers in
the hopes of receiving higher ransoms for the decryption of client-
sensitive data. Network analysis would help curb (Control) this
trend by providing automatic anomaly detection and preventing
breaches before they happen.
• Stronger Network Performance: Network traffic analysis allows
companies to assess where network traffic might spike and will
enable them to adapt and improve efficiency to avoid bottlenecks.
This also helps with effective resource management – cutting down
on IT costs.

86
Different Traffic Flows in the Enterprise
• NTA - Network Traffic Analysis Solution?
• Advanced Public Security Stature: A company using
effective network traffic analysis tools presents itself to the
public as more reliable and determined to provide more
efficient services – this attracts potential clients and deters
potential hackers who may try to infiltrate your business.
• Resource Efficiency: The constant active monitoring of
network traffic is impractical for most company staff to
maintain. The automation of this process gives businesses a
consistent level of advanced analysis while cutting the cost
of workers and overhead expenditure.

87
Different Traffic Flows in the Enterprise
• NTA - Network Traffic Analysis Solution?
• Rapid Response: Finding threats quickly leads to
less damage to the server. With an advanced
network traffic analysis tool, the time taken to
discover and mitigate these risks is dramatically
shorter - ensuring minimal damage is taken.
• Once it has been established that your company
does in fact need a superior network traffic
analysis tool in place, it becomes a question of
what exactly to look out for when trying to find
one that is best suited to your needs.

88
Different Traffic Flows in the Enterprise
• Classes for Network Traffic Analysis
• There are two methods of traffic-analysis attack,
passive and active. In passive traffic-analysis method,
the attacker extracts features from the traffic of a
specific flow on one side of the network and looks for
those features on the other side of the network.
• In active traffic-analysis method, the attacker alters the
timings of the packets of a flow according to a specific
pattern and looks for that pattern on the other side of
the network; therefore, the attacker can link the flows
in one side to the other side of the network and break
the anonymity of it.

89
Different Traffic Flows in the Enterprise
• Tools used for Analysis of Network Traffic
• SolarWinds Network Traffic Analysis, PRTG
Network Traffic Analyzer, Wireshark, NetFort
LANGuardian, and ManageEngine NetFlow
Analyzer are our top recommended network
traffic analyzers. Most of the tools follow
quote based pricing models.

90
Different Traffic Flows in the Enterprise
• Methods of Network Traffic Analysis
• Diagnostic Analysis,
• Predictive Analysis,
• Prescriptive Analysis,
• Text Analysis, and
• Statistical Analysis
• are the most commonly used data analytics
types. Statistical analysis can be further broken
down into Descriptive Analytics and Inferential
Analysis.

91
Different Traffic Flows in the Enterprise
• Network Traffic Analysis Implementation
• Step 1: Determine the Data Sources in Your
Organization. ...
• Step 2: Pick the Optimal Method for Accessing Data
Sources. ...
• Step 3: Begin with a Variety of Data Sample. ...
• Step 4: Set Up a Continuous Monitoring System, and
Decide Where to Send the Data That is Gathered.
• Step 5: Set the proper notification up for your IT Team

92
Different Traffic Flows in the Enterprise
• Stages of Network Traffic Analysis
• Many of you are probably familiar with the
four stages of Analytics:
• Descriptive,
• Diagnostic,
• Predictive, and
• Prescriptive.

93
Different Traffic Flows in the Enterprise
• Prevent Network Traffic Analysis
• The most useful protection from traffic analysis is to
encrypt your SIP traffic (. This would require the
attacker to gain access to your SIP proxy (or its call
logs) to determine who you called. Additionally, your
(S)RTP traffic itself could also provide useful traffic
analysis information.
• Session Initiation Protocol (SIP) is a signaling protocol
used for initiating, maintaining, modifying and
terminating real-time communications sessions
between Internet Protocol (IP) devices.

94
Different Traffic Flows in the Enterprise
• Prevent Network Traffic Analysis
• SRTP (Secure Real-Time Transport Protocol or
Secure RTP) is an extension to RTP (Real-Time
Transport Protocol) that incorporates
enhanced security features. Like RTP, it is
intended particularly for VoIP (Voice over IP)
communications.

95
 Quantum Cryptography
• What is a quantum? A quantum (plural:
quanta) is the smallest discrete unit of a
phenomenon. For example, a quantum of light
is a photon, and a quantum of electricity is an
electron. Quantum comes from Latin,
meaning "an amount" or "how much?" If
something is quantifiable, then it can be
measured.

96
 Quantum Cryptography
• Quantum mechanics
• Quantum mechanics is the branch of physics
that deals with the behavior of matter and
light on a subatomic and atomic level. It
attempts to explain the properties of atoms
and molecules and their fundamental particles
like protons, neutrons, electrons, gluons, and
quarks.

97
 Quantum Cryptography
• Gluon simple definition
• Gluon, the so-called messenger particle of the
strong nuclear force, which binds subatomic
particles known as quarks within the protons
and neutrons of stable matter as well as
within heavier, short-lived particles created at
high energies.

98
 Quantum Cryptography
• Quantum cryptography
• is a method of encryption that uses the quantum
mechanics to secure and transmit data in a way
that cannot be hacked.
• It is a system that is completely secure against
being compromised without the knowledge of
the message sender or the receiver.
• Quantum cryptography uses individual particles
of light, or photons, to transmit data over fiber
optic wire.
99
 Quantum Cryptography
• Quantum cryptography
• The photons represent binary bits. The security of
the system relies on quantum mechanics. These
secure properties include the following:
• particles can exist in more than one place or state
at a time;
• a quantum property cannot be observed without
changing or disturbing it; and
• whole particles cannot be copied.

100
 Quantum Cryptography
• Quantum cryptography
• These properties make it impossible to measure the
quantum state of any system without disturbing that
system.
• Photons are used for quantum cryptography because
they offer all the necessary qualities needed: Their
behavior is well understood, and they are
information carriers in optical fiber cables. One of
the best-known examples of quantum cryptography
currently is quantum key distribution (QKD), which
provides a secure method for key exchange.
101
 Quantum Cryptography
• Quantum cryptography at work
• In theory, quantum cryptography works by following a model
that was developed in 1984.
• Alice and Bob wish to exchange a message securely
• Alice initiates the message by sending Bob a key
• The key is a stream of photons that travel in one direction
• Each photon represents a single bit of data -- either a 0 or 1
• In addition to their linear travel, these photons are oscillating,
or vibrating, in a certain manner.

102
 Quantum Cryptography
• Quantum cryptography at work
• So, before Alice, the sender, initiates the message,
the photons travel through a polarizer
• The polarizer is a filter that enables certain photons
to pass through it with the same vibrations and lets
others pass through in a changed state of vibration

103
 Quantum Cryptography
• Quantum cryptography at work
• The polarized states could be
• vertical (1 bit),
• horizontal (0 bit),
• 45 degrees right (1 bit) or
• 45 degrees left (0 bit).
• The transmission has one of two polarizations
representing a single bit, either 0 or 1, in either
scheme she uses
104
 Quantum Cryptography
• Quantum cryptography at work
• The photons now travel across optical fiber
from the polarizer toward the receiver, Bob
• This process uses a beam splitter that reads
the polarization of each photon
• When receiving the photon key, Bob does not
know the correct polarization of the photons,
so one polarization is chosen at random

105
 Quantum Cryptography
• Quantum cryptography at work
• Alice now compares what Bob used to polarize the
key and then lets Bob know which polarizer she used
to send each photon
• Bob then confirms if he used the correct polarizer
• The photons read with the wrong splitter are then
discarded, and the remaining sequence is considered
the key

106
 Quantum Cryptography
• Quantum cryptography at work
• There is an eavesdropper present, named Eve
• Eve attempts to listen in and has the same tools as
Bob
• But Bob has the advantage of speaking to Alice to
confirm which polarizer type was used for each
photon
• Eve doesn't. Eve ends up rendering the final key
incorrectly

107
 Quantum Cryptography
• Alice and Bob would also know if Eve was
eavesdropping on them. Eve observing the
flow of photons would then change the
photon positions that Alice and Bob expect to
see

108
Quantum Cryptography

109
 Quantum Cryptography
• Usage of Quantum Cryptography
• More securely compared to traditional
cryptography
• After keys are exchanged between the involved
parties
• There is little concern that a malicious actor could
decode the data without the key
• If the key is observed when it is being
constructed, the expected outcome changes,
alerting both the sender and the receiver.

110
 Quantum Cryptography
• Usage of Quantum Cryptography

• This method of cryptography has yet to be fully developed; however,

there have been successful implementations of it:
• The University of Cambridge and Toshiba Corp. created a high-bit rate
QKD system using the BB84 quantum cryptography protocol.
• The Defense Advanced Research Projects Agency Quantum Network,
which ran from 2002 to 2007, was a 10-node QKD network developed
by Boston University, Harvard University and IBM Research.
• Quantum Xchange launched the first quantum network in the U.S.,
featuring 1,000 kilometers (km) of fiber optic cable.
• Commercial companies, such as ID Quantique, Toshiba, Quintessence
Labs and MagiQ Technologies Inc., also developed commercial QKD
systems

111
 Quantum Cryptography
• In addition to QKD, some of the more notable
protocols and quantum algorithms used in
quantum cryptography are the following:
• quantum coin flipping;
• position-based quantum cryptography; and
• device-independent quantum cryptography

112
 Quantum Cryptography
• Benefits of quantum cryptography
• Provides secure communication. Instead of difficult-to-
crack numbers, quantum cryptography is based on the
laws of physics, which is a more sophisticated and
secure method of encryption.
• Detects eavesdropping. If a third party attempts to
read the encoded data, then the quantum state
changes, modifying the expected outcome for the
users.
• Offers multiple methods for security. There are
numerous quantum cryptography protocols used.
Some, like QKD, for example, can combine with
classical encryption methods to increase security.
113
 Quantum Cryptography
• Limitations of quantum cryptography
Potential downsides and limitations that come with
quantum cryptography include the following:
 Changes in polarization and error rates. Photons
may change polarization in transit, which potentially
increases error rates.
 Range. The maximum range of quantum cryptography
has typically been around 400 to 500 km, with the
exception of Terra Quantum, as noted below.
 Expense. Quantum cryptography typically requires its
own infrastructure, using fiber optic lines and repeaters.
• Number of destinations. It is not possible to send keys
to two or more locations in a quantum channel.
114
115
116
117
118