Network Security

CSC342
Course Objectives
After successfully completing this course, you will be able to:
• Mastering Security Goals
• Exploring Control Types and Methods
• Securing your Networks
• Securing Hosts and Data
• Understanding Malware and Social Engineering
• Identifying Advanced Attacks
• Managing Risk
• Preparing for Business Continuity
• Understanding Cryptography
• Exploring Operational Security
Course Outline
• Mastering Security Goals
• Exploring Control Types and Methods
• Securing your Networks
• Securing Hosts and Data
• Understanding Malware and Social Engineering
• Identifying Advanced Attacks
• Managing Risk
• Preparing for Business Continuity
• Understanding Cryptography
• Exploring Operational Security
Text Books to Follow
.
 Chapter 1
Mastering Security Goals
Lecture Outline
• Understanding Security Goals
• Confidentiality
• Integrity
• Availability
• Safety
• Layered Security/Defense in Depth
• Introduction to Basic Risk Concepts
• Comparing Authentication Factors
• Dual-Factor and Multifactor Authentication
What is security
• Security means safety, as well as the measures taken to be safe or protected. ...
Or as the state of being free from danger
•
Network security is any activity designed to protect the usability and integrity of
your network and data. It includes both hardware and software technologies
Understanding Security Goals
• Security starts with several principles that organizations include as core security
goals. These principles drive many security-related decisions at multiple levels.
Understanding these basic concepts help to give us a solid foundation in security
• Network security goals:
• Confidentiality
• Integrity
• Availability
Security goals
Confidentiality
• Prevents the unauthorized disclosure of data.
• Confidentiality ensures that only authorized parties can view the
information.
• Authorized personnel can access the data, but the unauthorized
personnel cannot access the data.
• It is important that only approved individuals are able to access
important information.
How to achieve the confidentiality
• Encryption
• Access control
• Identification
• Authentication
• Authorization
Steganography
Encryption
• Scrambles data to make it unreadable by the unauthorized personnel.
Authorized personnel can decrypt data to access it, but the encryption
techniques make it extremely hard for the unauthorized personnel to
access encrypted data.
Access Control
• Identification, Authentication and Authorization combined provide
access controls and help ensure that only authorized personnel can
access data.
• Following are the key elements of the access controls.
• Identification
• Authentication
• Authorization
x
Access Controls – Identification
• Users claim an identity with a unique username.
• For example, both Maggie and Homer have separate user accounts
identified with unique usernames. When Maggie uses her account, She
is claiming the identity of her account
Access Controls – Authentication
• Users prove their identity with authentication, such as with a password.
• For example, Maggie knows her password, but no one else should know it. When
she logs on to her account with her username and password. She is claiming the
identity of her account and proving her identity with the password
Access Controls - Authorization
• We can grant or restrict access to the resources using an authorization method,
such as permissions
• For example, we can grant Maggie’s account full control access to files and
folders, and ensure Homer doesn’t have any permissions to access the data
Steganography
• Third method that we can use for confidentiality is steganography
• It is a practice of hiding data within data. Many people refer to it as
hiding data in plain sight
• For example, we can embed a hidden message in an image by
modifying certain bits within the file. If other people look at the file,
they won’t notice anything. However, if other people know what to
look for, they will be able to retrieve the message.
Integrity
• Integrity provides assurances that data has not changed. This includes
ensuring that no one has modified, tampered with, or corrupted the
data. Ideally, only authorized users modify data.
• However there are times when unauthorized or unintended changes
occur. This can be from unauthorized users, from malicious software
(malware), an through system and human errors. When this occurs, the
data has lost the integrity.
How to achieve integrity
• Hashing
• Hash is simply a number created by executing a hashing algorithm against
data, such as a file or message.
• hashing can be considered a type of one-way encryption
• The process outputs what is known as a hash, hash value, or message digest
• A hash function generates a f ixed-length value
• Digital signature
Availability
• Indicates that data and services are available when needed.
• For some organizations, this simply means that the data and services
must be available between 8:00 to 5:00
• Organizations commonly implement redundancy and fault-tolerant
methods to ensure high levels of availability for key systems.
Additionally, organizations ensure systems stay up to date with current
patches to ensure that software bugs don’t affect their availability.
.
Availability – Redundancy and Fault Tolerance
• Redundancy adds duplication to critical systems and provides fault
tolerance. If a critical component has a fault, the duplication provided
by the redundancy allows the service to continue without interruption.
In other words, a system with fault tolerance can suffer a fault, but
tolerate it and continue to operate
• A common goal of fault tolerance and redundancy techniques is to
remove each single point of failure (SPOF). If an SPOF fails. The
entire system can fail. For example, if a server has a single drive, the
drive is an SPOF because its failure takes down the server.
Availability – Patching
• Another method of ensuring system stays available is patching.
• Software bugs cause a wide range of problems, including security
issues and even random crashes.
• When software vendors discover the bugs, they develop and release
code that patches or resolves these problems.
• Organizations commonly implement patch management programs to
ensure that systems stay up to date with current patches
Safety
• Another common goal of security is safety.
• It refers to the safety of both individuals and an organization’s assets
• Safety is the state of being "safe", the condition of being protected
from harm or other non-desirable outcomes
• The following identify some things to consider safety for both people
and assets
• Safety of people
• Safety of assets
Layered Security/Defense in Depth
• Layered Security/defense in depth refers to the security of
implementing several layers of protection
• We can’t simply take a single action, such as implementing a firewall
or installing antivirus software, and consider yourself protected
• You must implement security at several different layers. This way, if
one layer fails, you still have additional layers to protect you.
•.
Introduction to Basic Risk Concepts
• One of the basic goals of implementing IT security is to reduce risk.
• Risk :In simple terms, risk is the possibility of something bad
happening.
• Or is then possibility or likelihood of a threat exploiting a vulnerability
resulting in a loss.
• Threat: is any circumstance or event that has the potential to
compromise confidentiality ,integrity ,or availability .
• Vulnerability: is a weakness. It can be a weakness in the hardware,
the software, the configuration, or even the users operating the system.
Comparing Authentication Factors
• As an introduction, authentication factors are
• Something you know
• Something you have
• Something you are
Comparing Authentication Factors – Something you
know
• This authentication factor typically refers to a shared secret, such as a password or
even a PIN. This factor is the least secure form of authentication. However,
security can be increased by following some simple guidelines
• Use Strong password
• Change passwords regularly
• Verify a user’s identity before resetting a password
• Do not reuse the same passwords
• Implement account lockout policies
• Change default passwords
• Do not write passwords down
• Do not share passwords
Comparing Authentication Factors – Something you have

• It refers to something you can physically hold.

• Common items in this factor are as follows
• Smart Cards
• Common Access Card (CAC) & Personal Identity Verification (PIV)
• Tokens or Key Fobs
Comparing Authentication Factors – Something you
are
• This factor uses biometrics for the authentication
• Biometric methods are the strongest form of authentication because
they are the most difficult for an attacker to falsify
• Biometric uses a physical characteristics, such as:
• Fingerprint and Thumbprint
• Handprint
Dual-Factor and Multifactor Authentication
• It uses two different factors of authentication such as something you
have and something you know.
• Dual-factor authentication often uses a smart card and a PIN, a USB
token and a PIN, or combining a smart card or hardware token with a
password
• Multifactor uses two or more factors of authentication
• For example we can combine the something you are factor with one or
more other factors of authentication
Summary
• Understanding Security Goals
• Integrity
• Availability
• Safety
• Layered Security/Defense in Depth
• Introduction to Basic Risk Concepts
• Comparing Authentication Factors
• Dual-Factor and Multifactor Authentication
Thank You
For your patience