HTTP Protocol and Security

Application Layer Services

• HTTP (Hypertext Transfer Protocol) is a core service used daily, but it is not secure, allowing eavesdroppers to see content and payloads.
• HTTP uses TCP (Transmission Control Protocol) at layer 4 and connects to a well-known port of 80.

HTTP vs. HTTPS

• HTTP is not secure, while HTTPS (Hypertext Transfer Protocol Secure) is secure.
• HTTPS uses either SSL (Secure Sockets Layer) or TLS (Transport Layer Security) to provide security.
• HTTPS authenticates and verifies the server using certificates, and enables a secure session between the user and server.
• HTTPS uses TCP at layer 4 and connects to a well-known port of 443.

Well-Known Ports

• HTTP servers listen on TCP port 80.
• HTTPS servers listen on TCP port 443.
• Clients use high-numbered, unused ports for sessions.

DTLS (Datagram Transport Layer Security)

DTLS (Datagram Transport Layer Security) is commonly used in modern day networking, especially in applications where UDP is preferred over TCP for better performance or real-time communication needs. Some common use cases for DTLS include VoIP (Voice over Internet Protocol) applications, video streaming services, online gaming, IoT devices, and many other scenarios where secure communication over datagrams is required. Overall, DTLS is a widely adopted protocol for securing datagram-based communication in various networking applications.

DTLS is a protocol that establishes a secure session and then uses UDP (User Datagram Protocol) datagrams to improve performance.

DTLS is used to reduce the overhead of TCP, which is connection-oriented and reliable.

DTLS, or Datagram Transport Layer Security, is able to provide security for network communication despite being based on UDP, a connectionless protocol. DTLS achieves this by incorporating security features such as encryption, authentication, and integrity checks within each datagram. This ensures that data exchanged over the network using DTLS is secured against interception or tampering.

Unlike TCP, which provides reliability through features like retransmission of lost packets and in-order delivery, UDP does not guarantee delivery or sequencing of packets. However, DTLS adds a layer of security by including mechanisms like handshake protocols, message authentication codes, and sequence numbers to validate and protect the data being transmitted. By combining the efficiency of UDP with the security capabilities of TLS, DTLS can establish secure communication channels for applications that require speed and low latency.

Network Visibility and Security

• Next-generation firewalls can accurately track and log network activity, including application layer services and well-known ports.
• These firewalls can help identify and block unauthorized services, such as HTTP servers running on devices.

Example of Next-Generation Firewall

• The Palo Alto Networks firewall provides a graphical user interface to monitor and log network activity.
• The firewall can identify and log HTTP and HTTPS traffic, including source and destination IP addresses, source ports, and well-known ports.

This quiz focuses on the application layer, specifically the Hypertext Transfer Protocol (HTTP) and its security limitations. It covers how HTTP works and its vulnerabilities.