Computer Science Module 2: Network Security

International & Access Foundation Programmes

• Computer Science Module, Semester 2, Part 5

Networks: Network Security

• Overview
  • What is network security?
  • Why do we need network security?
  • Who is vulnerable?
  • Common security attacks and countermeasures
    • Firewalls & Intrusion Detection Systems
    • Denial of Service Attacks
    • TCP Attacks (Spoofing)
    • Packet Sniffing
    • Social Engineering

Why Do We Need Security?

• Protect vital information while allowing access to those who need it
  • Trade secrets, medical records, personal data
• Provide authentication and access control for resources
  • Login, Passwords, Biometrics
• Guarantee resource availability (uptime 99.995% reliability)

Firewalls

• Basic problem - many network applications and protocols have security problems that change over time.

• Difficult for users to keep up with changes and keep hosts secure.

• Solution:

  • Administrators limit access to end hosts using firewalls.
  • Firewalls are kept up-to-date by administrators.

• Firewall analogy: A castle with a drawbridge; only one point of access to the network.

  • Can have positives and negatives

• Firewalls can be hardware or software.

  • Some routers have firewall functionality.
  • Unix, Windows XP/7/8, and Mac OS X have built-in software firewalls.

• DMZ (Demilitarized Zone): A segment between the Internet and the intranet, where web servers, email servers, and web proxies reside.

• Filtering packets based on rules (packet filtering firewalls).

• Windows 7 Default Firewall Configuration:

  • 135/tcp open loc-srv
  • 139/tcp open netbios-ssn
  • 445/tcp open microsoft-ds
  • 1025/tcp open NFS-or-IIS
  • 3389/tcp open ms-term-serv
  • 5000/tcp open UPnP

Ports (TCP & UDP)

• In the internet protocol suite, a port is an endpoint of communication in an operating system.

• 1024 well-known port numbers are reserved to identify specific service types on a host.

• A port is always associated with an IP address of a host.

• Example:

  • http://www.example.com:8080
  • http://72.56.123.233:80/

• List of registered ports.

• Typical TCP Ports:

  • 21: File Transfer Protocol (FTP)
  • 22: Secure Shell (SSH)
  • 23: Telnet remote login service
  • 25: Simple Mail Transfer Protocol (SMTP)
  • 53: Domain Name System (DNS) service
  • 80: Hypertext Transfer Protocol (HTTP)
  • 110: Post Office Protocol (POP3)
  • 119: Network News Transfer Protocol (NNTP)
  • 123: Network Time Protocol (NTP)
  • 143: Internet Message Access Protocol (IMAP)
  • 161: Simple Network Management Protocol (SNMP)
  • 194: Internet Relay Chat (IRC)
  • 443: HTTP Secure (HTTPS)

Types of Attacks

• Intrusion Detection: Monitoring for suspicious activity on a network based on known patterns of behaviour.

• Dictionary Attack (Brute Force): Trying passwords from a dictionary or list of common passwords.

• Denial of Service (DoS): Making a network service unusable by overloading the server or network.

• TCP Attacks: Attackers create IP packets and routers process them based on destination address. End-host may lie about other fields; malicious data inserted into the TCP stream, deceives the reciever that it's not from the attacker.

• Packet Sniffing: Capturing network traffic. Affects any broadcast-based network. A host listens to the data (plain-text passwords).

  • Solution: Encrypt data (SSL for https addresses; web browser knows how to trust based on certificate authorities).

  • Secure Socket Layer (SSL) for HTTPS addresses. Web browsers know how to trust HTTPS websites based on Certificate Authorities (CAs)

  • IPSec - Internet Protocol Security (IPsec) is protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet.

• Social Engineering: Exploiting human psychology to gain access to sensitive information. People can be lied to, manipulated, bribed, threatened, and harmed to give up valuable information

  • Example: "Your account has been hacked, please resend..."