Module 4
Essential Considerations for Web Security in Modern Network
Applications
Confidentiality
• Ensures that sensitive data like passwords, credit card details, and personal
information are encrypted and cannot be read by unauthorized parties.
• Achieved using protocols like TLS/SSL for secure data transmission.
Integrity
• Guarantees that data is not altered, tampered, or corrupted during transmission
between client and server.
• Ensured using Message Authentication Codes (MAC) and digital signatures.
Authentication
• Verifies the identity of users and servers before allowing communication.
• Implemented through digital certificates, username/password combinations,
OTPs, or biometric systems.
Access Control
• Controls who is allowed to access which resources on a website or server.
• Managed using authorization mechanisms, access control lists, and roles (user,
admin, guest).
Protection Against Common Web Attacks
• Essential to secure applications against:
o Cross-Site Scripting (XSS)
o SQL Injection
o Cross-Site Request Forgery (CSRF)
o Session Hijacking
Secure Session Management
• Ensures sessions are properly managed with unique session IDs, secure cookies, and
timeouts to prevent misuse.
Secure Data Storage
• Data stored on web servers and databases should be encrypted and securely
managed to prevent data breaches.
Regular Software Updates & Patching
• Keep servers, applications, and frameworks updated to protect against newly
discovered vulnerabilities.
Proper Logging & Monitoring
• Maintain activity logs and security alerts to detect suspicious activities and quickly
respond to breaches.
Compliance with Security Standards
• Adhere to standards like OWASP Top 10, PCI-DSS (for payment systems), ISO
27001, and GDPR (for data privacy).
Transport Layer Security (TLS):
TLS (Transport Layer Security) is a protocol that ensures secure communication over
networks. It provides confidentiality, integrity, and authentication services to applications
like HTTP, making web browsing secure (HTTPS).
TLS Layers & Protocols
1. TLS Record Protocol — Basic security service (encryption, MAC).
2. Handshake Protocol — Establishes security parameters and session keys.
3. Change Cipher Spec Protocol — Confirms the negotiated parameters are ready.
4. Alert Protocol — Sends error or alert messages.
5. Heartbeat Protocol — Maintains connection health (defined separately).
Connection A peer-to-peer secure link between client and server, transient (temporary)
A collection of security parameters (like keys, algorithms) established by the
Session
Handshake Protocol, can be reused
• Multiple connections can exist per session.
• Sessions reduce the overhead of negotiating new keys for every connection
Session State Parameters
• Session Identifier: Unique value to identify a session
• Peer Certificate: X.509 certificate of the peer (can be null)
• Compression Method: Algorithm to compress data before encryption
• Cipher Spec: Specifies encryption and hash algorithms
• Master Secret: 48-byte secret shared between client and server
• Is Resumable: Flag indicating if session can be reused
Connection State Parameters
• Client & Server Random Values
• MAC Secrets (Client & Server) — Keys for message authentication
• Write Keys (Client & Server) — Symmetric encryption keys
• Initialization Vector (IV) — Used for block cipher modes like CBC
• Sequence Numbers — For message ordering and anti-replay
IP Security
• IP Security (IPSec) is a framework of open standards for ensuring secure
communication over IP networks by providing services such as:
o Data confidentiality (encryption)
o Data integrity (protection from tampering)
o Data origin authentication
o Anti-replay protection
• It operates at the network layer (Layer 3) and protects both IPv4 and IPv6
communications.
• IPSec secures data at the IP packet level, making it transparent to applications and
higher-layer protocols.
Significance of IP Security Policies
IP Security Policies define rules and conditions under which IPSec security measures
are applied to IP traffic. They govern which data packets should be protected, how they
should be protected, and with whom secure communication can occur.
Key Roles of IP Security Policies:
1. Traffic Selection:
o Specify which traffic should be protected (e.g., encrypt HTTP traffic to a
server but allow DNS traffic in cleartext).
2. Security Methods Definition:
o Decide what security services to apply (encryption, authentication, or both) to
specific traffic.
3. Establish Security Associations (SA):
o IPSec relies on Security Associations (SAs) to define cryptographic
parameters like encryption algorithms, keys, and lifetimes for securing traffic.
4. Key Management Control:
o Work with key management protocols (like IKE) to establish and maintain
keys used for secure communication.
5. Network Access Control:
o Restrict which hosts or subnets can communicate securely, enhancing overall
network security.
6. Policy Enforcement and Consistency:
o Ensure security rules are uniformly applied across all participating devices in a
network.
7. Flexibility and Scalability:
o Support both point-to-point (site-to-site VPNs) and remote access (client-to-
site) secure connections.
Encapsulating Security Payload (ESP):
Encapsulating Security Payload (ESP) is a core protocol within IPSec that provides:
• Confidentiality through encryption
• Data integrity and authentication through optional Message Authentication Codes
(MAC)
• Anti-replay protection using sequence numbers
ESP works by encapsulating the payload of an IP packet and protecting it against
eavesdropping and tampering.
Field Purpose
Security Parameters Index Identifies the Security Association (SA) for this packet. Used to find
(SPI) cryptographic parameters.
Provides anti-replay protection by numbering packets sequentially
Sequence Number
and rejecting duplicates.
The actual encrypted data being transmitted (e.g., TCP, UDP, or
Payload Data
application data).
Ensures that data aligns properly for encryption block size
Padding
requirements.
Pad Length Indicates the size of the padding added to the payload.
Next Header Identifies the type of data (protocol) in the payload (e.g., TCP, UDP).
Authentication Data Contains the Integrity Check Value (ICV) — a MAC ensuring data
(optional) integrity and authenticity.
Security Associations (SA)
A Security Association (SA) in IPSec is a set of parameters (keys, algorithms, modes) that
defines how data will be securely exchanged between two IP endpoints.
✓ Each SA is unidirectional and uses either AH or ESP, not both.
Why Combine SAs?
Certain traffic flows may require multiple security services — like both authentication and
confidentiality, or layered protection between hosts and security gateways (firewalls). In
such cases, multiple SAs are bundled together.
This is called a Security Association Bundle — a sequence of SAs applied to the same traffic
flow.
Methods of Combining SAs (with Example)
[Link] Adjacency:
• Applying more than one security protocol (like ESP and AH) to the same IP packet
without tunneling.
• Example: ESP encryption first → then AH authentication.
• Works well for host-to-host protection.
[Link] Tunneling:
• Applying multiple security protocols via nested IP tunnels.
• Example: Data is first secured using one tunnel (say between firewalls), then
encapsulated into another for end-to-end protection.
• Suitable for multi-layered site-to-site VPNs.
3. Transport-Tunnel Bundle:
• Use authentication before encryption or vice versa for added protection.
• Example:
o Inner AH (Transport Mode) for authentication
o Outer ESP (Tunnel Mode) for encryption
• Ensures both confidentiality and authenticity with layered SAs.
Internet Key Exchange (IKE) protocol
Role of IKE:
Internet Key Exchange (IKE) is a protocol used in IPSec to:
• Automate the negotiation, creation, and management of Security Associations
(SAs).
• Securely exchange cryptographic keys and agree upon encryption/authentication
methods.
Working Phases of IKE:
IKE operates in two phases:
1. Phase 1 (Establish IKE SA):
o Establishes a secure, authenticated communication channel between two peers.
o Negotiates encryption, hash algorithms, authentication method, and Diffie-
Hellman parameters.
o Can use Main Mode (6 messages) or Aggressive Mode (3 messages).
2. Phase 2 (Establish IPSec SA):
o Uses the secure channel from Phase 1 to negotiate SAs for IPSec (ESP/AH).
o Agrees on protocols, keys, and lifetimes for IPSec connections.
o Uses Quick Mode (3 messages).