Introduction to IT Infrastructure

Landscape
 Unit 4
Network Security Overview

Network topology, Topologies are either physical or logical, Bus and

tree topology, Star topology, Mesh topology: Fully connected, what is
a firewall? Think time, IP addressing, Security zones, switching
concepts, Layer 2 switching, what is routing? Types of routing, Virtual
LAN, Dynamic vs. static VLANs,

Security basics, Basic components, Cryptography, Key encryption,

Private key encryption, Public key encryption, Secure messaging, Data
security, Network security, Application security, Why application
security is important? Security matters, Application security
challenges, Application security trends, Types of application security,
Application security in the cloud, What are security tests for
applications? Ethical hacking, Types of hackers, Benefits of ethical
hacking.
 Network topology
• Network topology refers to the arrangement of different elements like
nodes, links, or devices in a computer network.
• It defines how these components are connected and interact with each
other.

• Network topology affects many aspects of network functionality including

data transfer speeds, network efficiency, and network security.

• A network topology describes two different aspects of a communications

network: the physical topology and the logical topology.
• Network topologies are generally arranged in two ways:

• Physical (or underlay): This maps the actual connections in a network,

such as wires and cables and the placement of various components.

• Logical (or overlay): This shows how data flows within a network and from
one device to another, regardless of the physical connections among
devices.
• While the logical network uses the physical connections for data transfer,
the actual flow of data is defined by the logic not the physical connections.
 Network topologies

Point-to-point topology
• A point-to-point network, or a point topology, is the easiest network to
understand, and the most basic type of network topology.

• It’s simply two nodes that are connected by a single link.

• Data travels back and forth between these two endpoints.

Bus topology
• Bus Topology is a network type in which every computer and network device is connected to a single cable.
• It is bi-directional.
• It is a multi-point connection and a non-robust topology because if the backbone fails the topology crashes.
• In Bus Topology, various MAC (Media Access Control) protocols are followed by LAN ethernet connections like TDMA , Pure
Aloha , CDMA, Slotted Aloha , etc.
• The data transmission all flows through that one central connection.
• Because everything is connected in a straight line off one central cable, it’s a cost-effective topology, and simple to set up and add
new nodes.
• Bus topology carries transmitted data through the cable because data reaches each node, the node checks the destination
address (MAC/IP address) to determine if it matches their address.
Advantages of Bus Topology
• If N devices are connected to each other in a bus topology, then the number of cables required to connect them is 1, known as
backbone cable, and N drop lines are required.
• Coaxial or twisted pair cables are mainly used in bus-based networks that support up to 10 Mbps.
• The cost of the cable is less compared to other topologies, but it is used to build small networks.
Star Topology
• In Star Topology, all the devices are connected to a single hub through a cable.
• This hub is the central node, and all other nodes are connected to the central node.
• The nodes are positioned around that central hub in a shape that roughly resembles a star.
• This topology type makes it easier to troubleshoot issues with a particular node.
• If a single node fails, the rest of the network is unaffected.
• That said, if the central hub goes down, then the entire network goes down with it.
• In a star network, the performance of the entire network depends on the central hub and the connections to it.
Advantages of Star Topology
• If N devices are connected to each other in a star topology, then the number of cables required to connect them is N. So, it is easy
to set up.
• Each device requires only 1 port i.e., to connect to the hub, therefore the total number of ports required is N.
• It is Robust. If one link fails only that link will affect and not other than that.
• Easy to fault identification and fault isolation.
• Star topology is cost-effective as it uses inexpensive coaxial cable.
Mesh topology
• In a mesh topology, every device is connected to another device via a particular channel.
• In Mesh Topology, the protocols used are AHCP (Ad Hoc Configuration Protocols), DHCP(Dynamic Host Configuration Protocol),
etc.
• In a mesh network, each device is connected to at least one other node in the network.
• In a full mesh network, each node is connected to every other node.
• Since nodes can communicate directly with each other, rather than through a central hub, communication on a mesh network is
often very fast.
• A great example of a mesh network is the internet itself, where each computer is a node in a network provided by different internet
service providers that also connect to each other.
• This topology is intended to allow a very high level of redundancy by connecting each system within the network to every other
system on the network.
Advantages of Mesh Topology
• Communication is very fast between the nodes.
• Mesh Topology is robust.
• The fault is diagnosed easily. Data is reliable because data is transferred
among the devices through dedicated channels or links.
• Provides security and privacy.
Tree topology
• This topology has a hierarchical flow of data. In Tree Topology, protocols like DHCP and SAC (Standard Automatic Configuration )
are used.
• It’s useful to think of a tree topology as a combination of a bus network and a star network.
• In a tree topology, you still have one central hub that is connecting everything, but instead of single nodes that branch out from that
central root node, it’s other star networks.
• This topology allows for more devices to connect to a central data center, which speeds the flow of data. Like in a star network,
identifying issues with individual nodes is relatively easy.
• Tree topologies have the same drawbacks of both bus and star networks, namely the vulnerability to a single point of failure.
• If that central connection goes down, everything goes down.
Advantages of Tree Topology
• It allows more devices to be attached to a single central hub thus it decreases the distance that is traveled by the signal to come to
the devices.
• It allows the network to get isolated and also prioritize from different computers.
• We can add new devices to the existing network.
• Error detection and error correction are very easy in a tree topology.
Ring topology
• In a Ring Topology, it forms a ring connecting devices with exactly two neighboring devices.
• A number of repeaters are used for Ring topology with a large number of nodes, because if someone wants to send some
data to the last node in the ring topology with 100 nodes, then the data will have to pass through 99 nodes to reach the
100th node.
• Hence to prevent data loss repeaters are used in the network.
• The data flows in one direction, i.e., it is unidirectional, but it can be made bidirectional by having 2 connections between
each Network Node, it is called Dual Ring Topology. In-Ring Topology, the Token Ring Passing protocol is used by the
workstations to transmit the data.
• These kinds of networks are cheap to install and expand, and data flows quickly within the network. But a failure of a single
node can bring down the whole network.
• Dual-ring networks are used to protect against this type of failure.
• A dual-ring network features two concentric rings instead of one, and the rings send data in opposite directions.
• The second ring is used when there is failure in the first ring, and this type of network is often used to support critical
infrastructure.
Advantages of Ring Topology
• The data transmission is high-speed.
• The possibility of collision is minimum in this type of topology.
• Cheap to install and expand.
• It is less costly than a star topology.
 Firewall
• A firewall is a network security device, either hardware or software-based, which
monitors all incoming and outgoing traffic and based on a defined set of security rules
accepts, rejects, or drops that specific traffic.
• Accept: allow the traffic
• Reject: block the traffic but reply with an “unreachable error”
• Drop: block the traffic with no reply
• A firewall is a type of network security device that filters incoming and outgoing network
traffic with security policies that have previously been set up inside an organization.
• A firewall is essentially the wall that separates a private internal network from the open
Internet at its very basic level.
Working of Firewall
• Firewall match the network traffic against the rule set defined in its table.
• Once the rule is matched, associate action is applied to the network traffic.
• For example, Rules are defined as any employee from Human Resources department
cannot access the data from code server and at the same time another rule is defined
like system administrator can access the data from both Human Resource and
technical department.
• Rules can be defined on the firewall based on the necessity and security policies of the
organization.
• From the perspective of a server, network traffic can be either outgoing or incoming.
• Most traffic which reaches on the firewall is one of these three major Transport Layer
protocols- TCP, UDP or ICMP.
• All these types have a source address and destination address.
• Also, TCP and UDP have port numbers. ICMP uses type code instead of port number
which identifies purpose of that packet.
Types of Firewall
1. Packet Filtering Firewall
• Packet filtering firewall is used to control network access by monitoring outgoing and incoming packets and allowing
them to pass or stop based on source and destination IP address, protocols, and ports.
• It analyses traffic at the transport protocol layer (but mainly uses first 3 layers).
• Packet firewalls treat each packet in isolation.
• They have no ability to tell whether a packet is part of an existing stream of traffic.
• Only It can allow or deny the packets based on unique packet headers.
• Packet filtering firewall maintains a filtering table that decides whether the packet will be forwarded or discarded.
2. Stateful Inspection Firewall
• Stateful firewalls (performs Stateful Packet Inspection) are able to determine the connection state of packet, unlike
Packet filtering firewall, which makes it more efficient.
• It keeps track of the state of networks connection travelling across it, such as TCP streams.
• So, the filtering decisions would not only be based on defined rules, but also on packet’s history in the state table.
3. Software Firewall
• A software firewall is any firewall that is set up locally or on a cloud server.
• When it comes to controlling the inflow and outflow of data packets and limiting the number of networks that can be
linked to a single device, they may be the most advantageous.
• But the problem with software firewall is they are time-consuming.
4. Hardware Firewall
• They also go by the name “firewalls based on physical appliances.” It guarantees that the malicious data is halted
before it reaches the network endpoint that is in danger.
5. Application Layer Firewall
• Application layer firewall can inspect and filter the packets on any OSI layer, up to the application layer.
• It has the ability to block specific content, also recognize when certain application and protocols
(like HTTP, FTP) are being misused.
• In other words, Application layer firewalls are hosts that run proxy servers.
• A proxy firewall prevents the direct connection between either side of the firewall, each packet has to
pass through the proxy.
6. Next Generation Firewalls (NGFW)
• NGFW consists of Deep Packet Inspection,
• Application Inspection, SSL/SSH inspection and many functionalities to protect the network from these
modern threats.
7. Proxy Service Firewall
• This kind of firewall filters communications at the application layer and protects the network.
• A proxy firewall acts as a gateway between two networks for a particular application.
8. Circuit Level Gateway Firewall
• This works as the Sessions layer of the OSI Model’s .
• This allows for the simultaneous setup of two Transmission Control Protocol (TCP) connections.
• It can effortlessly allow data packets to flow without using quite a lot of computing power.
• These firewalls are ineffective because they do not inspect data packets; if malware is found in a data
packet, they will permit it to pass provided that TCP connections are established properly.
Functions of Firewall
• Every piece of data that enters or leaves a computer network must go via the firewall.
• If the data packets are safely routed via the firewall, all of the important data remains intact.
• A firewall logs each data packet that passes through it, enabling the user to keep track of all network activities.
• Since the data is stored safely inside the data packets, it cannot be altered.
• Every attempt for access to our operating system is examined by our firewall, which also blocks traffic from unidentified or undesired
sources.
Firewalls Protect Against
• Infiltration by Malicious Actors: Firewalls can block suspicious connections, preventing eavesdropping and advanced persistent threats
(APTs).
• Parental Controls: Parents can use firewalls to block their children from accessing explicit web content.
• Workplace Web Browsing Restrictions: Employers can restrict employees from using the company network to access certain services
and websites, like social media.
• Nationally Controlled Intranet: Governments can block access to certain web content and services that conflict with national policies or
values.
Advantages
Protection From Unauthorized Access: Firewalls can be set up to restrict incoming traffic from particular IP addresses or networks,
preventing hackers or other malicious actors from easily accessing a network or system. Protection from unwanted access.
• Prevention of Malware and Other Threats: Malware and other threat prevention: Firewalls can be set up to block traffic linked to known
malware or other security concerns, assisting in the defense against these kinds of attacks.
• Control of Network Access: By limiting access to specified individuals or groups for particular servers or applications, firewalls can be
used to restrict access to particular network resources or services.
• Monitoring of Network Activity: Firewalls can be set up to record and keep track of all network activity.
• Regulation Compliance: Many industries are bound by rules that demand the usage of firewalls or other security measures.
• Network Segmentation: By using firewalls to split up a bigger network into smaller subnets, the attack surface is reduced, and the security
level is raised.
 IP addressing
• An Internet Protocol address (IP address) is a numerical label such
as [Link] that is assigned to a device connected to a computer
network that uses the Internet Protocol for communication.
• IP addresses serve two main functions: network interface identification, and
location addressing.
• Internet Protocol version 4 (IPv4) defines an IP address as a 32-bit number.
• However, because of the growth of the Internet and the depletion of available
IPv4 addresses, a new version of IP (IPv6), using 128 bits for the IP address,
was standardized in 1998.
• IPv6 deployment has been ongoing since the mid-2000s.
• The IP address space is managed globally by the Internet Assigned Numbers
Authority (IANA), and by five regional Internet registries (RIRs) responsible in
their designated territories for assignment to local Internet registries, such
as Internet service providers (ISPs), and other end users.
• An IP address serves two principal functions: it identifies the host, or more
specifically, its network interface, and it provides the location of the host in the
network, and thus, the capability of establishing a path to that host.
• IP addresses are not produced randomly.
• They are generated mathematically and are further assigned by the IANA (Internet
Assigned Numbers Authority), a department of the ICANN.
• ICANN stands for Internet Corporation for Assigned Names and Numbers.
• It is a non-profit corporation founded in the US back in 1998 with an aim to manage
Internet security and enable it to be available by all.
Subnetworks
• IP networks may be divided into subnetworks in both IPv4 and IPv6.
• For this purpose, an IP address is recognized as consisting of two parts:
• the network prefix in the high-order bits and the remaining bits called the rest field, host
identifier, or interface identifier (IPv6), used for host numbering within a network.
• The subnet mask or CIDR notation determines how the IP address is divided into
network and host parts.
Types of IP Address
IP Address is of two types:
IPv4:
• Internet Protocol version 4. It consists of 4 numbers separated by the dots. Each number can
be from 0-255 in decimal numbers.
• But computers do not understand decimal numbers, they instead change them to binary
numbers which are only 0 and 1.
• Therefore, in binary, this (0-255) range can be written as (00000000 – 11111111).
• Since each number N can be represented by a group of 8-digit binary digits.
• So, a whole IPv4 binary address can be represented by 32-bits of binary digits.
• In IPv4, a unique sequence of bits is assigned to a computer, so a total of (2^32) devices
approximately = 4,294,967,296 can be assigned with IPv4.
IPv6:
• IPv6 Address which is a 128-bit IP address.
• IPv6 is written as a group of 8 hexadecimal numbers separated with colons(:).
• It can be written as 128 bits of 0s and 1s.
• Since, a unique sequence of binary digits is given to computers, smartphones, and other
devices to be connected to the internet.
• So, via IPv6 a total of (2^128) devices can be assigned with unique addresses which are
actually more than enough for upcoming future generations.
An IP address is classified into the following types:
1. Public IP Address:
• This address is available publicly and it is assigned by your network provider to your router,
which further divides it to your devices. Public IP Addresses are of two types,
• Dynamic IP Address: When you connect a smartphone or computer to the internet, your
Internet Service Provider provides you an IP Address from the range of available IP Addresses.
• Now, your device has an IP Address, and you can simply connect your device to the Internet
and send and receive data to and from your device.
• The very next time when you try to connect to the internet with the same device, your provider
provides you with different IP Addresses to the same device and also from the same available
range.
• Since IP Address keeps on changing every time when you connect to the internet, it is called a
Dynamic IP Address.
• Static IP Address:
• Static address never changes. They serve as a permanent internet address.
• These are used by DNS servers.
• Static IP Address provides information such as device is located on which continent, which
country, which city, and which Internet Service Provider provides internet connection to that
device.
• Once, we know who is the ISP, we can trace the location of the device connected to the
internet. Static IP Addresses provide less security than Dynamic IP Addresses because they
are easier to track.
2. Private IP Address:
• This is an internal address of your device which are not routed to the internet
and no exchange of data can take place between a private address and the
internet.
3. Shared IP addresses:
• Many websites use shared IP addresses where the traffic is not huge and very
much controllable, they decide to rent it to other similar websites so to make it
cost-friendly.
• Several companies and email sending servers use the same IP address (within
a single mail server) to cut down the cost so that they could save for the time the
server is idle.
• 4. Dedicated IP addresses:
• A dedicated IP Address is an address used by a single company or an individual
which gives them certain benefits using a private Secure Sockets Layer (SSL)
certificate which is not in the case of a shared IP address.
• It allows to access the website or log in via File Transfer Protocol (FTP) by IP
address instead of its domain name.
• It increases the performance of the website when the traffic is high. It also
protects from a shared IP address that is black-listed due to spam.
 Switching
• In computer networking, Switching is the process of transferring data packets from one device to another in a network, or from one
network to another, using specific devices called switches.
• A computer user experiences switching all the time for example, accessing the Internet from your computer device, whenever a
user requests a webpage to open, the request is processed through switching of data packets only.
• Switching takes place at the Data Link layer of the OSI Model.
• This means that after the generation of data packets in the Physical Layer, switching is the immediate next process in data
communication.
• A switch is a hardware device in a network that connects other devices, like computers and servers. It helps multiple devices share
a network without their data interfering with each other.
• When a data packet arrives, the switch decides where it needs to go and sends it through the right port.
• A switch does this effectively by maintaining a switching table, (also known as forwarding table).
• A network switch is more efficient than a network Hub or repeater because it maintains a switching table, which simplifies its task
and reduces congestion on a network, which effectively improves the performance of the network.
Process of Switching
The switching process involves the following steps:
• Frame Reception: The switch receives a data frame or packet from a computer connected to
its ports.
• MAC Address Extraction: The switch reads the header of the data frame and collects the
destination MAC Address from it.
• MAC Address Table Lookup: Once the switch has retrieved the MAC Address, it performs a
lookup in its Switching table to find a port that leads to the MAC Address of the data frame.
• Forwarding Decision and Switching Table Update: If the switch matches the destination
MAC Address of the frame to the MAC address in its switching table, it forwards the data frame
to the respective port.
• However, if the destination MAC Address does not exist in its forwarding table, it follows
the flooding process, in which it sends the data frame to all its ports except the one it came
from and records all the MAC Addresses to which the frame was delivered.
• This way, the switch finds the new MAC Address and updates its forwarding table.
• Frame Transition: Once the destination port is found, the switch sends the data frame to that
port and forwards it to its target computer/network.
Types of Switching
There are three types of switching methods:
1. Message Switching: This is an older switching technique that has become obsolete. In message switching technique, the entire
data block/message is forwarded across the entire network thus, making it highly inefficient.
2. Circuit Switching: In this type of switching, a connection is established between the source and destination beforehand. This
connection receives the complete bandwidth of the network until the data is transferred completely.
This approach is better than message switching as it does not involve sending data to the entire network, instead of its destination
only.
3. Packet Switching: This technique requires the data to be broken down into smaller components, data frames, or packets.
These data frames are then transferred to their destinations according to the available resources in the network at a particular time.
This switching type is used in modern computers and even the Internet. Here, each data frame contains additional information about
the destination and other information required for proper transfer through network components.
• Datagram Packet Switching: In Datagram Packet switching, each data frame is taken as an individual entity and thus, they are
processed separately. Here, no connection is established before data transmission occurs. Although this approach provides
flexibility in data transfer, it may cause a loss of data frames or late delivery of the data frames.
• Virtual-Circuit Packet Switching: In Virtual-Circuit Packet switching, a logical connection between the source and destination is
made before transmitting any data. These logical connections are called virtual circuits. Each data frame follows these logical paths
and provides a reliable way of transmitting data with less chance of data loss.
 Routing
Routers
• It is a networking device that forwards data packets between computer networks.
• Also, it helps to direct traffic based on the destination IP address. It ensures that data
reaches its intended destination.
• As the router connects different networks, it manages data traffic between them. The
Router operates at Layer 3 (the network layer) of the OSI Model.
• It is also responsible for determining the best path for data to travel from one network
to another.
Routing
• It refers to the process of directing a data packet from one node to another.
• It is an autonomous process handled by the network devices to direct a data packet to
its intended destination.
• Routing is a crucial mechanism that transmits data from one location to another across
a network (Network type could be any like LAN, WAN, or MAN).
• The process of routing involves making various routing decisions to ensure reliable &
efficient delivery of the data packet by finding the shortest path using various routing
metrics.
• Routing of a data packet is done by analyzing the destination IP Address of the packet.
Different Types of Routing
1. Static Routing
• In this, routing configuration is done manually by the network administrator.
• A network administrator has full control over the network, routing the data packets to their
concerned destinations
• Routers will route packets to the destination configured manually by the network administrator.
2. Dynamic Routing
• Dynamic Routing is another type of routing in which routing is an autonomous procedure
without any human intervention.
• Packets are transmitted over a network using various shortest-path algorithms and pre-
determined metrics.
• It is also known as adaptive routing.
• In this, the router adds new routes to the routing table based on any changes made in the
topology of the network.
• The autonomous procedure of routing helps in automating every routing operation from adding
to removing a route upon updates or any changes made to the network.
3. Default Routing
• Default Routing is a routing technique in which a router is configured to transmit packets to a
default route that is, a gateway or next-hop device if no specific path is defined or found.
• It is commonly used when the network has a single exit point.
Working Principle of Routing:
Step 1: Communication initiation
• The first step that typically happens is, one node (client or server) initiates a communication across a network using HTTP protocols.
Step 2: Data Packets
• The source device now breaks a big chunk of information into small data packets for reliable and efficient transmission. This process is
called de-assembling and encapsulating the data payload. Then each data packet is labeled with the destination node’s IP address.
Step 3: Routing Table
• The Routing table is a logical data structure used to store the IP addresses and relevant information regarding the nearest routers.
• The source node then looks up the IP addresses of all the nodes that can transmit the packet to its destination selects the shortest path
using the shortest path algorithm and then routes accordingly.
• The Routing Table is stored in a router, a network device that determines the shortest path and routes the data packet.
Step 4: Hopping procedure
• In the procedure or routing, the data packet will undergo many hops across various nodes in a network till it reaches its final destination
node. Hop count is defined as the number of nodes required to traverse through to finally reach the intended destination node.
• This hopping procedure has certain criteria defined for every data packet, there’s a limited number of hops a packet can take if the packet
exceeds that, then it’s considered to be lost and is retransmitted.
Step 5: Reaching the destination node
• Once all the data packets reach their intended destination node, they re-assemble and transform into complete information that was sent by
the sender (source node). The receiver will perform various error-checking mechanisms to verify the authenticity of the data packets.
• Overall, the data packet will be transmitted over the least hop-count path as well as the path on which there is less traffic to prevent packet
loss.
•
Routing Protocols
• RIP (Routing Information Protocol): It is a distance-vector protocol that uses hop count as a metric.
• OSPF (Open Shortest Path First): OSPF is a link-state protocol that finds the shortest path using the Dijkstra algorithm.
• EIGRP (Enhanced Interior Gateway Routing Protocol): It is a hybrid protocol that combines features of distance-vector and link-
state.
• BGP (Border Gateway Protocol): It is a path-vector protocol that is used for routing between different autonomous systems on
the internet.

Routing Metrics
Distance Vector Routing
• In this type of routing protocol, all the nodes that are a part of the network advertise their routing table to their adjacent nodes
(nodes that are directly connected) at regular intervals.
• With each router getting updated at regular intervals, it may take time for all the nodes to have the same accurate network view.
• Uses fixed length sub-net, not suitable for scaling.
• Algorithm used: Bellman Ford Algorithm to find the shortest path.
Link State Routing
• Link State Routing is another type of dynamic routing protocol in which routes advertise their updated routing tables only when
some new updates are added. This results in the effective use of bandwidth.
• All the routers keep exchanging information dynamically regarding different links such as cost and hop count to find the best
possible path.
• Uses a variable length subnet mask, which is scalable and uses addressing more effectively.
• The algorithm used: Dijkstra’s Algorithm to find the shortest path.