LECTURE 5: Security in Network

INTRODUCTION

Computer Networks = Interconnected collection of autonomous computers.

CLASSIFICATIONS OF NETWORKS

Broadcast Networks

Single communication channel tat is shared by all the machines on the network
Allow the possibility of addressing a packet to all destinationd by using a special code in the address field.
When a packet with this code is transmitted, it is received and processed by every machine in the network. This is called broadcasting.

Point-to-Point Networks

Consist of many connections  between individuals pairs of machines.
From source to destination, a packet may have to first visit one or more intemediate machines.
Often multiple routes of different lengths are possible, so routing algorithms play an important role in point-to-point networks.

Distance is important as a classification metric because different techniques are used at different scales


Local Area Networks (LAN)

• Georgraphically close group of computers that can talk to each other.
• Privately-owneed networks within a single building or campus of up to a few kilometres in size.
• Wide;y used to connect personal computers and workstations in company offices or factories to share resources

Metropolitan Area Networks (MAN)

• Bigger version of LAN.
• Normally uses similar technology
• Might cover a group of nearby corporate offices or a city and might be either private or public
• Can support both data and voice and might even be related to the local cable television network.
  

Wide Area Networks (WAN)

Spans a large geographical area, often a country or continent.and often associated with a large organization.
Can be made up of any combination and numbrs of WANs, LANs or single computers.


NETWORK TOPOLOGY

Star

Ring

Mesh

Bus

OSI MODEL

WHO CAN CAUSE SECURITY PROBLEMS??

• Student - Have fun snooping on people's email
• Hacker - Test out someone's security system
  
• Sales rep - Claim to represent all of Europe not just Androrra
  
• Businessman - Discover a competitor's strategic marketing plan
  
• Ex-employee - Get revenge for being fired
  
• Accountant - Embezzle money from a company
  
• Stockbroker - Deny a promise made to a customer by email
  
• Con-man - Steal credit card numbers for sale
  
• Spy - Learn an enemy's military strength
  
• Terrorist - Steal germ warfare secret

INTERTWINED AREAS IN NETWORK SECURITY PROBLEMS

• Secrecy
• Authentication
• Non-Repudiation 
• Integrity Control 

NETWORK SECURITY ISSUES

• Sharing
• Complexity of System
• Unknown perimeter
• Many points of Attack
• Unknown Path

SECURITY EXPOSURE

• Privacy
• Data Integrity
• Authenticity
• Covert Channels

NETWORK SECURITY THREATS

Threats = circumstances, condition, or event with the potential to cause harm to personnel and/or network resources in the form of destruction, disclosure, modification of data, denial of service or fraud, waste and abuse.Network security threats include impersonation, eavesdropping, denial of service, packet relay and packet modification.

Impersonating 

Common ways to identify and authenticate users include the use of physical keys, account names and passwords and biometrics checks.

Eavesdropping

Allows cracker to make a complete transcript of network activity. As a result, a cracker can obtain sensitive information, such as passwords.

Denial of Service

Multi-user, multi-tasking operating system are subject to DoS attacks where one user can user can render the system unusable for legitimate users by "hogging" a resource or damaging or destroying resources so that they cannnot be used.Three common form of network DoS attacks are service overloading, message floading and signal floading.

Packet Relay

Refers to the recording and re-transmission of message packets in the network. It is a significant threat for programs that require authentication sequences.

Packet Modification

Significant integrity threat, which involves one system intercepting and modifying a packet destined for another system.

NETWORK SECURITY CONTROL

Encryption = technique used to safeguard information while it is stored within a network node.

  

Link Encryption VS End-to-end Encryption

Security within hosts

                        Msg exposed in sending host                  Msg encrypted in sending host                   

                        Msg exposed in intermediate nodes        Msg encrypted in intermediate nodes

Roles of User

                        Applied by sending host                                             Applied by sending process

                        Invisible to user                                                          User applies encryption

                        Host maintains encryption                                           User must find algorithm

                        One facility for all users                                               User selects encryption

                        Can be done in harware                                              Software implementation

                        All or no msg encryption                                             User chooses to encrypt or not

Implementation Concerns

                       Requires one key per host pair                                         Requires one key per user pair

                       Provides node authentication                                            Provides user authentication

Access Control

• Port protection
• Automatic Call-back
• Differentiated Access Rights
• Node Authentication

User Authentication

• Password
• Challenge-response system

Authentication in Distributed System

• Kerberos

Firewall Characteristics

• Entire All relation link or activity from within out have to pass firewall.
• Done or Conducted by block limiting either through physical all accessing to local and also in configuration.
• Only enlisted activity recognized which can pass firewall by arranging policy of at local security.
• Have to tie or strong relative to attack weakness.

Types of firewall

• Screening router

~Simplest
~Sees only addresses and service protocol type
~Auditing difficult
~Screens based on connection rules
~Complex addressing rules can make configuration tricky

• Proxy gateways

~Somewhat complex
~Sees full text of communication
~Can audit activity
~Screes based on behavior of proxies
~Simple proxies can substitute for complex addressing rules

• Guards

~Most complex
~Sees full text of communications
~Can audit activity
~Screens based on interpretation of msg content
~Complex guard functionality can limit assurance


Intrusion Detection System (IDS)

• Device or software tools or hardware tools that monitor activity to identify malicious or suspicious events.
• Use to detect unauthorized access to a computer or network.
• Required to detect all type of malicious network traffic and computer usage.
• Compose of several components which are sensor, console and engine.
• Correcting system configuration error
• Installing and operating traps to record information about intruders

Types of IDS

• Signature-based Intrusion Detection
• Heuristic Intrusion Detection
  

Posted by aziekotani