01 Network Security

Network Security

Encryption

• **Encoding **message so that only **authorised **people can access
• Sender uses secret key and encryption algorithm: Plaintext → Cipher text
• Receiver uses secret key and decryption algorithm: Cipher text → Plaintext

Symmetric encryption

• Send and receiver share:
  • One secret key
  • Same encryption and decryption key
• Fast processing but low security if key is intercepted
• Common use: Advanced encryption standard (AES)

Asymmetric encryption

• Private and public key that are mathematically related
  • Cannot be derived from each other
• Sender uses receiver’s public key to encrypt
• Only receiver’s private key can decrypt
• Slower process but higher security
• Common use: Rivest-Shamir-Adleman (RSA)

Digital Signature

• Electronic signature: Used by someone to sign contracts
• Digital signature: Encryption/Decryption of hash secures data associated to doc
• Functions
  • Authentication: Verifies the authenticity of the document
  • Non-repudiation: Sender cannot deny sending message
  • Integrity: The message is not altered in transit

Hashing

• Generating a short string of text (called hash, hash value or digest) from data
• Unique hash for different data (if not, it is known as a ‘hash collision’)
• Impossible to recover the original data from the hash

Digital Signature using Hashing

1. Sender uses hash algorithm to create hashed version of message
2. Sender uses private key to encrypt the hash to digital signature
3. Both the message (encrypted or not) and the digital signature are sent to receiver
4. Receiver uses the sender’s public key to decrypt the digital signature back to the sender’s version of hash
5. Receiver uses the same hash algorithm to create a new hash from the received message
6. If the two hashes match, it means the data is not altered and is sent by the known sender

Authentication

• Identification: User claims an identity
• Authentication: System validating identity of a user / User proving their identity
• Authorisation: Validating the granted permission of an user to access the resources

Authentication factors

• Something you know (password)
• Something you have (NRIC)
• Something you are (fingerprint)
• Multi-Factor Authentication is at least 2 authentication factors

Malware

• Malicious software that aims to damage computer systems and/or gain unauthorised access to them, which may cause the computer to crash or have its data deleted
• Virus
  • Attach itself to file or program
  • Remains dormant until executed by user
  • Replicate to infect other computers in network
• Worms
  • Continuously self-replicating
  • Spreads automatically across computer networks without human interaction
• Trojan Horse
  • Appears as legitimate program
  • Runs malicious code to damage computer after gaining access
  • Not self replicating
• Ransomware
  • Locks computer
  • Encrypts data
  • Forces user to pay ransom
• Adware
  • Unwanted
  • Displays advertisement
• Spyware
  • Hidden program
  • Secretly collects and transmits information to attacker

Denial of Service

• Attacks network traffic and exhaust bandwidth and resources
• Until system cannot fulfil legitimate requests
• Distributed denial of service (DDoS): Multiple compromised devices (botnets) to attack the system

Social Engineering Attack

• Use of deception and trickery to convince users to provide data or to violate security guidelines

• Phishing

  • Seems to be from respected source
  • Claims to require private information for verification

• Spam

  • Flooded with emails/messages that carry advertisements or viruses

Protection Schemes (user)

• Keep the computer operating system updated
• Install anti-virus software
• Backup and archive important documents regularly
• Do not click on suspicious link or emails
• Do not connect to untrusted public Wi-Fi

Protection Schemes (computing professional)

• Firewall
  • Prevent unauthorised access from entering private network
  • Monitors and controls all network traffic based on a set of security rules
  • Software and hardware level
  • Filtering functions:
    • Port (application)
    • MAC (device)
    • IP addresses (server)
    • Content (parental control)
  • Limitations:
    • Bypass it by inserting malicious attacks inside legitimate programs
    • Cannot protect against Internal attacks (like viruses)
    • May block some legitimate programs
• Proxy Server
  • Intermediary for requests from clients seeking resources from other servers
  • Hide IP address and login details
  • Control incoming and outgoing traffic at individual application level
  • Caching machine
• Virtual Private Network
  • Unblock censored websites
  • Adds encryption on any data transmitted
  • controls all the traffic that goes through the network
• Intrusion Detection System
  • Scans and monitors the network traffic or system for malicious activities
  • Sounds an alert when it detects an attack
  • NO action against the attack
  • Host based and Network based
  • Applicable to software and hardware
• Intrusion Protection System
  • Take actions to block the unauthorised access or malicious packets
  • May drop packets, reset connections, sound alerts and quarantine intruders
  • Applicable to software and hardware
• Unified Threat Management
  • Devices can combine many security features
  • E.g. Firewall, IDS, IPS and many other features
• No protection scheme is perfect, constant updates of technology is highly important

Code of Conduct

• Ensure the servers are up-to-date and equipped with protection schemes
• Keep the confidentiality and the safely of the clients
• Constantly upgrade their knowledge and skills