Module – I
Introduction to
Network Security &
Cryptography
Contents Overview
Computer security and Network security
CIA
Services, Mechanisms and Attacks
Classical Encryption Techniques
Substitution
Transposition
Introduction to Stegnography
11/07/23
Computer Security
Computer security deals with securing a
standalone computer’s hardware and
software.
Keeping standalone machines updated and
properly patched is one of the most important
keys of this type of security.
11/07/23
Computer Security
Computer security deals with securing a
standalone computer’s hardware and
software.
Keeping standalone machines updated and
properly patched is one of the most important
keys of this type of security.
11/07/23
Network Security
Network security protects any data sent
through devices in your network to
ensure that the information isn’t modified
nor intercepted.
Network security protects the
organization’s IT infrastructure against
threats such as:
Viruses, spyware, adware, trojan horses,
worms,
Hackers,
Zero-day and denial of service attacks
Network Security
To protect information, network security
system must include the following
components:
Firewalls
Anti-virus software
Intrusion detection systems (IDS)
Intrusion prevention systems (IPS)
Virtual private networks (VPN)
Comparision
Information Security
Information security protects both
physical and digital data from
unauthorized access, usage, disclosure,
disruption, modification, inspection,
destruction, and recording.
Information security should be the
foundation of any startup business that’d
like to start developing its security
program.
The Confidentiality, Integrity, and
Availability Triad (CIA) is the information
security model of most organizations
Cyber Security
Cyber security is a subset of information
security.
It secures individual computers, computer
networks, and the intercommunication
between all the devices in an organization.
Cyber security is designed to protect
organization’s digital footprint.
Alleviating cyber threats is vital not only
from a business point of view but also to
avoid any unwanted fines due to data loss.
Cyber Security
Some common forms of cyber security
threats include ransomware, malware,
phishing, and baiting.
Hackers usually use these attacks against
small businesses with limited resources to
manage them.
Comparision
Security Goals / Objectives
re
Confidentiality
cu
S e
Availability
Integrity
Goals of Computer/Information Security - CIA
11/07/23
Confidentiality
This service ensures that the
data/information transmitted over the
network is not disclosed to unauthorized
users.
Confidentiality can be achieved by using
different encryption techniques such as only
legitimate users can analyze and understand
the transmission.
Symmetric and Asymmetric cryptographic
standards such as DES, AES, RSA, etc.,
achieve confidentiality.
Integrity
The function of integrity control is to assure
that the data is received in verbatim as sent
by authorized party.
The data received contains no modification,
insertion or deletion.
Cryptographic Hash functions such as SHA,
MD5 etc., achieve Integrity
Availability
The service/device should be available to
the authorized person when needed.
Denial of Service (DoS) attack is a method
frequently used by hackers to disrupt this
goal.
Countermeasures to protect against DoS
attacks include firewalls and routers.
Information Security
Essential network and computer security
requirements
Security related terms
Vulnerability : It is a flaw in a system’s
design, security procedures, internal
controls, etc., that can be exploited by
cybercriminals.
Threat : A potential for violation of security,
which exists when there is a circumstance,
capability, action, or event that could breach
security and cause harm.
A threat is a possible danger that might
exploit a vulnerability.
Security related terms
Risk : It is a potential consequence of the
loss or damage of assets or data caused by a
threat.
Risk can never be completely removed, but it
can be managed to a level that satisfies an
organization’s tolerance for risk.
Security related terms
Attack : An assault on system security that
derives from an intelligent threat; that is, an
intelligent act that is a deliberate attempt to
evade security services and violate the
security policy of a system.
Control : To survive the attacks and resist
against them, countermeasures and
controls are taken.
OSI SECURITY ARCHITECTURE
ITU-T Recommendation X.800, Security
Architecture for OSI, defines a systematic
approach for defining the requirements for
security and characterizing the approaches
to satisfying those requirements.
The International Telecommunication Union -
Telecommunication Standardization Sector (ITU-T) is a
United Nations-sponsored agency that develops standards,
called Recommendations, relating to telecommunications and
to open systems interconnection (OSI).
OSI SECURITY ARCHITECTURE
The OSI security architecture is useful to
managers as a way of organizing the task of
providing security.
It provides some security services and
some mechanisms to implement those
services.
OSI SECURITY ARCHITECTURE
Security mechanism
A process (or a device incorporating such a
process) that is designed to detect, prevent,
or
recover from a security attack.
Security service
A processing or communication service that
enhances the security of the data processing
systems and the information transfers of an
organization.
The services are intended to counter
security attacks, and they make use of one
Security Attacks
Two categories
1) A passive attack attempts to learn or
make use of information from the system but
does not affect system resources.
2) An active attack attempts to alter system
resources or affect their operation.
Security Attacks
Taxonomy of attacks with relation to security
goals
Security Services
T
Security Mechanisms
ITU-T (X.800) also recommends some
security mechanisms to provide the security
services.
Encipherment
Data Integrity
Digital signature
Authentication exchange
Traffic padding
Routing control
Notarization
Access control
S
T
S
T