Network Security and

Protocols
Chapter 18

Chapter Objectives - I

Explain the different Network Security Threats

Explain the need for Network Security
Discuss the objectives of Cryptography
List the various types of Cryptosystems
Explain the concept of Digital Signatures
Identify the different Authentication Protocols

Chapter 18

Chapter Objectives - II

Discuss the different methods of

ensuring privacy
Explain the concept of Firewall
Discuss the concept of VLAN
Explain the various Fault Tolerant And Redundancy
Methods
List the components of a Perfect Server
Demonstrate the implementation External Network
Security
List the different Network Security Protocols

Chapter 18

Recall - I

The combination of centralized processing model

and distributed processing model is called the clientserver model
Advantages of light wave technology are:

Chapter 18

Cost effective solution

Offers very high bandwidth
Very easy to install

Recall - II

The different remote access methods used are:

Using phone lines and modems

Using ISDN lines
Using X.25

Advantages of connectionless internetworking are:

flexibility, robust and no unnecessary overhead
The two process involved in routing are host routing
and router routing

Chapter 18

Threats

Prevent users from accessing the required

resources for performing their work

Types of Threats

Internal

Chapter 18

External

Internal Threats

Malicious practices done by the local networks

users that do not allow efficient sharing of the
network resources
Common internal threats are:

Chapter 18

Unauthorized Access
Data Destruction
Administrative Access
System Crash/Hardware Failure
Virus

Protecting from Internal Threats

Methods of protecting internal threats largely

dependent on policies rather than technology
To protect the network from internal threats you need
to implement:

Chapter 18

Passwords
User Account Control
Policies
Fault Tolerance

External Threats

External threats can exist in two forms:

Attacker manipulates the user to gain access to the

network
Hacker at a remote location uses technical methods
to gain illegal access to your network

Common external threats are:

Social Engineering
Hacking

Chapter 18

Protecting from External Threats

Securing network from external threat is a

competition between hackers and security people
To protect the network from external threats you
need to provide:

Chapter 18

Physical protection
Firewalls
Encryption
Authentication
Public Keys and Certificates
VLAN

10

Need for Network Security

Network security - Mechanism that protects the

network resources from being attacked by the
outside world
Hackers constantly look out for loopholes in the
network security and snoop into a network

Chapter 18

11

Security Attacks - I

Break the security barrier of the network and access the

network resources
Types of Security
Attacks

Active

Chapter 18

Passive

12

Case Study - I
The Customer Service department of MoneyMaker
bank provides online services to the customers. It
has been a month since maintenance tasks have
been performed on the computers of the
department at Hyderabad branch. The customer
service department of Hyderabad branch reports
that the response of the computers has become
slow and pop-ups continually plague Internet
browsers. The computers are infected with
spyware.

Chapter 18

13

Problem

The performance of the computers in the costumer

service department has reduced

Chapter 18

14

Suggested Solution
Spyware is software and not a virus that hides itself
somewhere on the computer and collects
information about the user. Spyware is often
downloaded onto the computer when you download
other free software or when you visit certain
Websites. To solve the problem the spyware can be
removed using a removal tool such as Spybot. This
will help in improving system performance.

Chapter 18

15

Implementing External Network

Security - I

Implementing external network security was not

necessary while dial up connections were used
Arrival of high speed internet connection has
completely changed security aspect for home
computers
Users who use Asymmetric digital subscriber line
(ADSL) or a cable modem is the main target for the
hackers
Windows XP now has an Internet Connection Firewall
(ICF) available

Chapter 18

16

Implementing External Network

Security - II

SOHO routers are connected to provide security to

networked systems sharing a single Internet
connection
Large networks employ a dedicated firewall between a
gateway router and the protected network
A demilitarized zone (DMZ) can also be
implemented to prevent access to the network

Chapter 18

17

Cryptography

Cryptography is a science that deals with securing

information
Objectives of Cryptography are:

Chapter 18

Message Confidentiality
Message Integrity
Message Authentication
Message Nonrepudiation
Entity Authentication

18

Types of Cryptosystems

Cryptographic systems consists of algorithms and

procedures used for encrypting the messages
Types of cryptographic systems:

Symmetric Cryptographic Systems

Asymmetric Cryptographic Systems

Symmetric Cryptographic Systems use same keys

for encryption and decryption
Asymmetric Cryptographic Systems use two keys,
one for encryption and other for decryption

Chapter 18

19

Encryption/Decryption

Encryption refers to conversion of plain text into

cipher text
Cipher algorithm is used to transform plain text into
cipher text
Different types of traditional ciphers used to encode
the message fall in to two broad categories:

Chapter 18

Substitution ciphers
Transposition ciphers

20

Public Key Encryption/Decryption

Uses a combination of two keys the private key

and the public key
Private key is known only to the receiver of the
message

Chapter 18

21

Secret Key Encryption / Decryption

Uses the same key to encrypt and decrypt the

message
Algorithm used for decrypting the message is
inverse of algorithm that is used to encrypt message

Chapter 18

22

Digital Signatures - I

Used to authenticate the origin of the document

Come under the asymmetric cryptography category
Can be accomplished in two ways:

Chapter 18

Signing the document

Signing the digest of the document

23

Digital Signature - II

Signing the document

Signing the digest

Chapter 18

24

Authentication Protocol

Authentication is a process by which the identity of

the concerned party is identified before starting the
communication process
Data traffic is encrypted using symmetric key
cryptography for performance reasons
Public key cryptography is used for developing
authorization protocols as well as creating a session
key

Chapter 18

25

Authentication based on Shared Secret

Key -I

Challenge response protocols used for authentication

using shared secret key

Chapter 18

26

Authentication using Kerberos

Three types of servers involved in Kerberos

protocol:

Chapter 18

Authentication Server (AS)

Ticket-Granting Server (TGS)
Real Server

27

Authentication using Public Key

Cryptography

Certification Authority : Organization that binds a

public key to an entity and issues a certificate

Chapter 18

28

Firewall - I

Firewall is a system that blocks all unwanted and

unauthorized access of the system resources
Firewall can be set using a router, switch, or a
bridge
Firewall is basically present at the junction point or
gateway between two networks like a private and
public network
Firewalls can be hardware or software
Basic types of firewalls are:

Chapter 18

Packet-Filter Firewalls
Proxy Firewalls
29

Firewall - II

Demilitarized Zones in Firewall

Chapter 18

Network that is usually present between an internal

and external network of an organization
DMZ host provides services for external networks thus
providing cover for internal networks against intruders

30

Case Study - II
Network administrator John has installed a new
Web browser on the computer of the employee in
the Mumbai branch of the MoneyMaker Bank. The
user complains to John that he is unable to connect
to the Internet using the new Web browser and a
firewall warning message appears.

Chapter 18

31

Problem

Cannot view the Web pages on the new browser.

Chapter 18

32

Suggested Solution

The Windows firewall might block a program from

connecting to the Internet. To solve this problem you
might need to add the program to the exception list
of the firewall.

Chapter 18

33

VLAN - I

Individual broadcast domains created by the switch

are called virtual LANs.
Different characteristics used to group stations in a
VLAN are:

Port Numbers
MAC addresses
IP addresses
Multicast IP Addresses
Combination

IEEE standard 802.1Q defines format of frame

tagging in VLAN

Chapter 18

34

VLAN - II

VLAN can be configured in three ways: Manual,

Automatic, and Semiautomatic
Three methods used for communication between
switches are:

Table Maintenance
Frame tagging
Time Division Multiplexing (TDM)

Advantages of VLAN are:

Network Management
Creating Virtual Work Groups
Security

Chapter 18

35

Fault Tolerance and Redundancy

Shared data of a network should have better

protection rather than having to restore the backups
with difficulty
The capability of a server to continue operating in
case of a hardware failure is known as fault
tolerance
To implement fault tolerance you have to make the
data redundant on the serving system

Chapter 18

36

RAID

RAID is a technology that uses a collection of hard

disks to share and replicate data
Different levels of RAID are RAID 0, 1, 2, 3, 4, 5, 6,
0+1, 10, 53 and linear RAID

Chapter 18

37

Network-Attached Storage (NAS)

Used for implementing a server just for file sharing

A prebuilt system usually running LINUX with Samba
and/or Network File System (NFS)
Devices have DHCP enabled and require very little or
no configuration to run

Chapter 18

38

Storage area network (SAN)

SAN is a network whose

primary aim is to transfer
data between disk arrays,
tape drives and servers
The various SAN
components are:

Chapter 18

Fiber channel Switches

Hosts and Host Bus
Adapters
Storage Devices
Cabling and Cable
Connectors
39

Tape Backup

Tape backup becomes essential incase of a

hardware crash or damage to the server
Magnetic tape is the oldest method of storing data
from the computer
Tape backup options fall in to three major groups:

Chapter 18

Quarter-inch tape (QIC)

Digital Audio Tape (DAT)
Digital Linear Tape (DLT)

40

Perfect Server - I

Network that shares data requires specialized

hardware so as to share data as fast as possible
Hardware requirement for Speed

Chapter 18

Fast NICS : Increasing the data throughput and

making it do more than one task at a time
Faster Drives : Using a PATA or a SCSI drive and
implementing RAID 5 for data protection

41

Perfect Server - II

Servers require reliability, speed as well as data

protection
Good Power
Antivirus Program
Environment

Chapter 18

42

Hardware Requirement for speed

The hardware requirements for a server and a

workstation differ from each other completely
Workstations do not require the speed, reliability
and data backup. Servers on the other hand require
reliability, speed, as well as data protection
The two things that can make the server provide
good speed are:

Chapter 18

Fast NICs
Fast Drives

43

Reliability - I

A steady AC power supply is to be provided to all

the systems
The different methods of providing good power are:

Dedicated Circuits
Surge suppressors
Uninterruptible Power Supply (UPS)
Backup Power

Another problem along with faulty power is computer

viruses

Chapter 18

44

Reliability - II

Five typical types of viruses are:

Boot sector
Executable
Macro
Trojan
Worm

Damage due to virus attacks can be prevented by

not allowing the virus from entering the system
Necessary to provide a good environment for the
server to improve its reliability

Chapter 18

45

Protocols

Different protocols are used at different layers of the

OSI model for providing security to the users
The different protocols used are:

Chapter 18

Secure Socket Layer (SSL)

Internet Protocol Security (IPSec)
Point-to-Point Tunneling Protocol (PPTP)
Point-to-Point Protocol (PPP)
Serial Line Interface Protocol (SLIP)

46

SLIP

Serial Line Internet Protocol (SLIP) is used to

connect the computer to the Internet using serial
connection such as the dial-up modem
Serial Line Internet Protocol was designed for Data
link protocol for telephony
However, SLIP only supported TCP/IP and not
NetBEUI or IPX network.

Chapter 18

47

PPP - I

One of the common protocols for point to point

access

PPP addressed all of the shortcomings of SLIP

Different services provided by PPP are as follows:

Chapter 18

Defines the format of the frames to be exchanged

between devices.
Defines how the devices can negotiate for
establishment of link and exchange of data
Defines how network layer data is encapsulated in the
data link frame.
Defines how the devices can authenticate each other
48

PPP - II

Provides multiple network layer services that

support different network layer protocols.
Provides connection over multiple links.
Provides network address configuration which is
useful incase a user needs a temporary network
address to connect to the Internet

Chapter 18

49

PPTP

Network protocol that allows secure transfer of data

from a remote client to a private server
It is the Microsoft VPN encryption protocol
The three processes involved in PPTP are:
PPTP connection and communication
PPTP control connection
PPTP data tunnelling

Chapter 18

50

IPSec

Protocol set that was developed by Internet

Engineering Task Force (IETF) for providing security
to a packet at the network level
IPSec operates in two modes:

Chapter 18

Transport Mode
Tunnel Mode

51

SSL

SSL is a protocol developed by Netscape for

transmitting private documents over the Internet.
Web pages that use SSL have URLs starting with
https
Different services provided by SSL for the data
received by application layer are:

Chapter 18

Fragmentation
Compression
Message Integrity
Confidentiality
Framing
52

Summary - I

There are two types of threats: Internal and External

threats
Internal threats are malicious practices done by the
local networks users that do not allow efficient
sharing of the network resources
External threats are threats in which a hacker at a
remote location uses technical methods to gain
illegal access to your network

Chapter 18

53

Summary - II

Network security is a mechanism that protects the

network resources from being attacked by the
outside world
Security attacks can be passive or active
Cryptography is a science that deals with securing
information and involves securing of messages,
authentication, and digital signatures

Chapter 18

54

Summary - III

Symmetric cryptographic systems use the same

keys to encrypt and decrypt the message
Asymmetric cryptographic systems use two keys
one for encryption and the other for decryption for
securely transmitting the data
In digital signatures private key is used to encrypt
the message and public key is used to decrypt it

Chapter 18

55

Summary - IV

Authentication based on shared secret key uses

challenge response protocols
Encryption refers to conversion of plain text into
cipher text and the cipher algorithm is used to
transform plain text into cipher text
Decryption means converting cipher text back to
plain text and same cipher algorithms are used
decrypting

Chapter 18

56

Summary - V

Public key encryption / decryption use public key to

encrypt the message and private key to decrypt the
message
Secret key encryption / decryption use the shared
secret key to encrypt and decrypt the message
Firewall is a system that blocks all unwanted and
unauthorized access of the system resources
Demilitarized zone (DMZ) is a network that is usually
present between an internal and external network of
an organization

Chapter 18

57

Summary - VI

A Virtual local area network (VLAN) is a switched

network that is logically segmented with respect to
functions, project teams, or applications
IEEE standard used for VLAN 802.1Q defines the
format of frame tagging and the format to be used in
multi-switched backbones
Station in a VLAN can be configured in three ways:
manual, semiautomatic, and automatic
RAID uses different techniques of using multiple
devices for data protection and increasing the
speeds

Chapter 18

58

Summary - VII

Network Attached Storage (NAS) is used for

implementing a server for file sharing
Storage area network (SAN) is a network whose
primary aim is to transfer data between computer
storage devices and computer systems
Tape backup becomes essential incase of a
hardware crash or damage to the server room

Chapter 18

59

Summary - VIII

Perferct servers require reliability, speed, data

protection and specialized hardware
NIC can be made faster by increasing the data
throughput and making the NIC smarter by making it
do more than one task at a time
Reliability can be achieved by providing a secure
environment for the server and providing redundant
hardware components for the server in case of
component failure

Chapter 18

60

Summary - IX

Small office/home office connection is a setup where

few networked systems share a single Internet
connection
SSL is designed to provide security and
compression services to data generated from the
application layer
IPSec is a protocol set that was developed by
Internet Engineering Task Force (IETF) for providing
security to a packet at the network level

Chapter 18

61

Summary - X

Point-to-Point Tunneling Protocol (PPTP) is a

network protocol that allows secure transfer of data
from a remote client to a private server
Point-to-Point Protocol (PPP) is one of the common
protocols for point to point access
SLIP was designed to send IP datagram from one
device to another that were connected serially

Chapter 18

62