Network security

Содержание и основные понятия

Back to the table of contents
Alterna · Chapter 5 · page 5.4
Network security
How to protect the data online, from web-based screens to TLS encryption. We're looking at the mechanisms that stand between you and the threats.
In chapter 4, you learned about passwords, phishing, and personal data protection.
Network level
- how infrastructure protects data from interception, invasion, and attacks.
Firewall, IDS, VPN, TLS, each of these tools, solves their task in multilevel protection.
GEF · Basic
PLF · Infred
01
online threats
What exactly are we protecting and from whom
GEF
Three pillars of information security (CIA)
🔒
Confidentiality
confidentiality
Data are available only to authorized users, protection against interception and unauthorized access.
✓
Integrity
integrity
Data have not been changed unauthorized. Protection against substitution and modification.
⚡
Availability
Accessibility
Data and services are available when needed, DDoS and malfunction protection.
Main network threats
Threat
Description
Breaks
Interception
The intruder reads traffic online.
Confidentiality
MITM (Man-in-the-Middle)
The attacker is built between the client and the server
Confidentiality + Integrity
DDoS
Mass requests "will" the server
Accessibility
SQL injection
Implementation of harmful SQL code through forms
Confidentiality + Integrity
Port scanning
Exploration of open ports to find vulnerabilities
- (preparation of the attack)
Spoofing
Counterfeiting IP/MAC address
Integrity
02
Firewall Internet screen
Filter that decides to skip the package or lock
GEF
PIF
What makes firewall
Network screen
(firewall) is a device or software that analyses network packages and decides whether to skip them or block them, based on a set of devices.
Regulations
.
Firewall types
Type
What she analyzes
Example of the rule
Packet filter
Headings: IP, port, protocol
"Forbid TCP-port 23 (Telnet) from the outside"
Stateful
+ state of connection
"Dismissing responses to outgoing requests"
Application (proxy)
Content (HTTP, DNS)
"Close requests to Malware.ru"
NGFW
+ IDS, in-depth analysis
"Close Trafficking with Exploit Sign"
Firewall rules
Each rule shall contain:
Protocol
(TCP/UDP/ICMP),
Source address
,
Port of source
,
destination
,
port of destination
,
Action
(ALLOW / DENY).
Rules processed
Top Down
The first parallel rule applies, and at the end of the rule, it is usually "default deny" to ban anything that is not permitted.
Principle
The right policy is firewall:
To ban everything, to allow only the necessary
(Default deny) The reverse approach (permit everything, ban the known bad) is much less safe.
03
IDS and IPS — Detection and Prevention
Systems that see anomalies in traffic
PIF
IDS — Intrusion Detection System
Finds
Suspicious activity and
alerts.
It doesn't block traffic, it's just a monitor.
IPS — Intrusion Prevention System
Detects and blocks
It's an automatic attack, it's worth a break-up, an analogy: a security guard on a walk-in.
Detection methods
Method
How it works
Plus
Minutes
Signature-based
Comparison with the base of known attack(s)
Exactly for known threats
Doesn't see new ones (zero-day)
Anomaly-based
Deviation from the "normal" traffic profile
Catch new attacks.
False Response
Heuristic
Conduct analysis (Euristics)
Flexible
It's complicated.
04
VPN is a virtual private network.
Coded tunnel via public Internet
GEF
PIF
What makes VPN
VPN
(Virtual Private Network)
encrypted tunnel
The whole traffic goes through this tunnel -- the service provider and the network intruders see only the cipher.
Why do you need VPN?
Security in public Wi-Fi
- in a cafe, the airport traffic is encrypted.
Remote access to the corporate network
- An employee works from home like an office.
Confidentiality
- Provider can't see which sites you visit.
VPN Protocols
Protocol
Circulation
Speed
Application
OpenVPN
AES-256
Average
Universal, open
WireGuard
ChaCha20
High
Modern, light
IPsec
AES / 3DES
Average
Corporate site-to-site
PPTP
MPPE (weak)
High
I'm tired, not safe.
Important
VPN
Doesn't make you anonymous
The VPN service provider sees your traffic. Tor is required for anonymity.
05
TLS and PKI — How HTTPS Works
SSL certificates, certification centres, TLS handshake
PIF
What is TLS
TLS
Transport Layer Security is an encryption protocol at the transport level.
Circulation
— data in transit are unreadable
Auction
- You're sure you're talking to the right server.
Integrity
- Data not replaced
TLS Handshake is a handshake
Client Hello
- browser sends supported encryption algorithms
Server Hello
== sync, corrected by elderman ==
certificate
Certificate verification
- The browser checks the signature of the Certification Centre (CA)
Exchange of keys
- a common symmetrical key (through RSA or Diffie-Hellman) is generated
Encrypted communications
- All further traffic is encrypted with a symmetrical key
PKI Open Key Infrastructure
PKI
Public Key Infrastructure is a system of certification centres (CA) that issue digital certificates, and the certificate confirms that "this public key is indeed owned by the domain.com".
Relationship to Chapter 4
In chapter 4, you learned that HTTPS uses encryption. Now you can see the entire chain: browser \TLS handshake \ check the CA certificate of exchange of keys \ encoded channel. The value \ in the target line is the result of this procedure.
Warning
If the browser shows "Certificate Ineffective", it could mean a MITM attack.
Don't go on.
Enter passwords on a website like this!
06
Categorization and hashing
Symmetrical and asymmetric encryption, hash functions, digital signatures
PLF · Infred
Symmetric encryption
One key
It's used for both encryption and decryption. Like a lock with one key: closed, opened the same key.
Algoritm
Key
Application
AES-256
256 bits
Standard: TLS, VPN, disk encryption
ChaCha20
256 bits
WireGuard, mobile devices
DES / 3DES
56 / 168 Bits
Tired, hacked.
Asymmetric encryption
Two Keys
Public (public) and private (public).
coded
to the privates--
Decrypt
.
🔑
Public Key
open
They're encrypting the data for you. As a mailbox, anyone can drop a letter.
🗝️
Private Key
Secret
You're the only one holding it, you're deciphering it, as the key to the mailbox, only you.
Algoritm
Basis
Application
RSA
Large number factoration
TLS handshake, digital signatures
Diffie-Hellman
Disaggregated logarithm
Key Exchange (ECDHE in TLS)
ECDSA
Elliptic curves
Subscriptions in the box, TLS
How TLS Works
TLS uses
both
Asymmetrical encryption (RSA/ECDHE) for hand-shake keys, symmetrical (AES/ChaCha20) for traffic encryption, asymmetry is 100 to 1,000 times slower, so it is used only at the beginning.
Heshing
Hesh function
- Unilateral conversion: from any size received
fixed
I can't reverse it.
Algoritm
The length of hash
Application
SHA-256
256 bits (64 hex)
TLS, locker, file check
SHA-512
512 bits (128 hex)
Passwords, certificates
MD5
128 bits (32 hex)
I'm tired, there's been a conflict.
Hash function properties
Determination
- Same data ~ same hash
Irreversibility
- You can'