Computer Science Module: Network Security

International & Access Foundation Programmes - Computer Science Module, Semester 2, Part 5: Networks - Network Security

• Overview of Network Security:
  • What is network security?
  • Why is network security needed?
  • Who are the vulnerable parties?
  • Common security attacks and countermeasures
  • Firewalls & Intrusion Detection Systems
  • Denial of Service Attacks
  • TCP Attacks (Spoofing)
  • Packet Sniffing
  • Social Engineering

Why Network Security Is Needed

• Protecting sensitive information, such as trade secrets, medical records, and personal data, while allowing access to authorized users.
• Providing authentication and access control for resources.
• Mechanisms like logins, passwords, and biometrics.
• Maintaining resource availability and reliability (99.995% uptime).

Firewalls

• Basic Problem: Network applications and protocols can have security issues requiring periodic updates.
• Difficulty: Keeping up with these updates for users and keeping their systems secure.
• Solution: Firewall administratort limit access to end hosts by using firewalls. Firewalls kept updated by administrators.
• Analogy: Firewall as a castle with a drawbridge - only one access point. Can have positive and negative aspects.
• Types: Hardware-based (within routers) or software-based (integrated within operating systems like Unix, Windows XP/7/8, and Mac OS X).
• DMZ (De-militarized Zone): A security zone separating the internal network (intranet) from the internet. Web servers, email servers, and web proxies are housed in the DMZ.

Firewalls - Packet Filtering

• Used to filter incoming and outgoing network packets; this filtering happens based on pre-set rules.
• The way a typical default Window's 7 install. filters packets:
  • 135/tcp open loc-srv
  • 139/tcp open netbios-ssn
  • 445/tcp open microsoft-ds
  • 1025/tcp open NFS-or-IIS
  • 3389/tcp open ms-term-serv
  • 5000/tcp open UPnP

Ports

• Ports are endpoints of communication in an operating system within the internet protocol suite.
• 1024 well-known port numbers are reserved to indicate specific service types on a host.
• Each port is always linked to an IP address.

Typical TCP Ports

• 21 File Transfer Protocol (FTP)
• 22 Secure Shell (SSH)
• 23 Telnet remote login service
• 25 Simple Mail Transfer Protocol (SMTP)
• 53 Domain Name System (DNS) service
• 80 Hypertext Transfer Protocol (HTTP)
• 110 Post Office Protocol (POP3)
• 119 Network News Transfer Protocol (NNTP)
• 123 Network Time Protocol (NTP)
• 143 Internet Message Access Protocol (IMAP)
• 161 Simple Network Management Protocol (SNMP)
• 194 Internet Relay Chat (IRC)
• 443 HTTP Secure (HTTPS)

Types of Attacks

• Intrusion Detection: Monitors for suspicious activity using well-known behavioral patterns.

• Dictionary Attack (Brute Force): Tries various passwords from a dictionary to gain unauthorized access.

• Denial of Service (DoS): Overloads a network service to make it unavailable.

• TCP Attacks: Attackers create IP packets for malicious purposes affecting destination addresses or inserting malicious code into TCP streams that appear to come from another source.

• Packet Sniffing: Monitoring network traffic to capture data like passwords. Encryption methods like SSL protect against packet sniffing by encrypting the data.

• Social Engineering: Manipulating people to reveal sensitive information.

• IPSec (Internet Protocol Security): A protocol suite that secures Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session.