fundamental concepts of network security

Session Notes

This course, INFA 620, is the second course in the University of Maryland Global Campus's Information Assurance (IA) specialization of the Master of Science in the Information Technology program. It is also a course taken by non-IA track majors in the UMGC Graduate School. The course provides a firm foundation to network security for both majors and non-majors.

As many other courses at UMGC, this course does not require a textbook. We will be using Open Educational Resources (OERs) for the course. Each session Content will include OER's for that session. 

Major technological advances in computers and telecommunication systems have placed information, as tangible corporate assets, at risk. With the proliferation of corporate databases, telecommunication networks, and personal computers and smart devices, there are numerous threat paths which require risk and security management. Network is at the perimeter of information assets in an enterprise. Protecting the perimeter is the first line of defense.

The Course Outcomes of INFA 620 are to:

• Illustrate and explain fundamental architectures of networks and the Internet as well as their underlying protocols.
• Describe and analyze Internet security issues and available countermeasures.
• Identify security issues and their countermeasures  in wireless networks
• Learn state-of-the-art technologies for network access control and protecting data through networks.

Getting Started

Our first session of INFA 620 serves primarily as an introduction to some of the important concepts in cyber security.

Computer Security Terms

The term security in its most basic sense means the protection of assets from harm. Assets are anything of value, including physical, tangible items such as buildings, people, and the items they use, and intangible assets, such as information or knowledge. In the computer security realm, most organizations divide the overall practice of security into two categories: physical security and information security; our emphasis is admittedly on information security. The emphasis of the course is the network or perimeter security.

There are many definitions used for the term information security. The official definition used by the US Government, as defined in the Federal Information Security Management Act (FISMA), is "protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality, and availability."  Business and Security

It is very important for us to understand the relationship between business and security. There is often a mis-perception that security measures are used to block or slow down business. On the contrary, good security practices provide business agility as well as good return on investment over the long haul.

Computer Security Goals

These are challenging days for computer security. For years, computer security was the exclusive domain of the technophiles, and security threats against computer systems were mostly of the nuisance variety. With the advent of the Internet, and particularly in the last dozen or so years with the increase in network connectivity to access the World Wide Web, today's information security environment has reached the point of persistent, continuous risk for all connected computer systems, in businesses, the government, and private homes.

At a national level, cybersecurity has become a major concern, if not obsession. Under the Bush administration, the Department of Homeland Security (DHS) developed national policies to deal with risks to the critical information infrastructure that includes Internet and cyberspace. You can read the policy at http://www.dhs.gov/national-strategy-secure-cyberspace Information security has never had a higher profile or greater level of priority attached to it, and the attention dedicated to identifying and mitigating risks grows every day.

This course will give you a substantial overview of the major issues in network and Internet security. We will review networking fundamentals, specifically OSI and TCP/IP layering, and IP and TCP protocols. We will study cryptography fundamentals which provide the basic technology for data/message confidentiality, integrity and authenticity. We will study typical attacks at various layers of Internet/networks and protection mechanisms to thwart the attacks. IPSec and VPN, and firewall are powerful network security technologies. We will study them. Since communication is increasingly on wireless medium, we will pay particular attention to wireless network security.

We will now introduce a few key information security terms. Most of these should be familiar to you from INFA 610.

What constitutes Security?

There are three core aspects or properties to security:

• Confidentiality: Accessed only by authorized parties
• Integrity: Modified by authorized parties only in authorized ways 
• Availability: Accessible to authorized parties at appropriate time

Two more aspects are often needed to provide a complete picture of security. They are:

• Authenticity:  A message is genuine and from a right source (Often, authenticity is considered a dimension of integrity, since the definition of integrity permits changes to information only by authorized parties.)
• Accountability: Traceability of an action to the party that is responsible for causing it.

Sometimes we speak about the triple-A techniques. The triple-A techniques refer to authentication, authorization, and accounting.

The authentication mechanisms include biometric techniques, certificates, challenge-response handshakes, Kerberos authentication, one-time passwords, passwords and PINs, RADIUS, and security tokens.

The authorization process determines whether the user has the authority to perform a particular task. Authorization or lack of it is enforced using access control mechanisms such as access control lists (ACLs), intrusion protection systems, physical access control, and traffic filters (firewall). Security is an ongoing process requiring constant measuring and adjusting. This is critical to detect breaches when they occur. The layered security approach provides several different types of defenses around the network to make penetration increasingly difficult. Firewalls, virtual private networks, access control devices, intrusion detection systems, and network scanning devices can be/are implemented at different layers.

Attacks and threats are not the same. To understand this, one more term, vulnerability, needs to be introduced. Here is a definition of these three terms:

• Threat is a set of circumstances that has the potential to cause loss or harm, i.e., a threat is a possible danger.
• Vulnerability is a weakness in a system/network.
• Attack is a human or process that exploits vulnerability on the system. It is the realization of a threat.

 Attacks, specifically network attacks, can be broadly classified into two types: (1) passive, and (2) active. Passive attacks generally affect confidentiality. In networks, two kinds of passive attacks are:

• Eavesdropping: Reading/obtaining  message content by unauthorized parties
• Traffic analysis: Deducing the content of a message (by unauthorized parties) from meta data of network transmission (e.g., packet header, packet length, and frequency of message exchanges between parties)

Active attacks can affect all dimensions of security. Active network attacks can be classified into the following categories:

• Modification: Altering, delaying, or reordering messages
• Denial of Service: preventing a network or network based service from becoming available or being accessed
• Masquerade: An entity pretending to be another entity(so as to cause future attacks and  inflict  damages
• Replay: passive capturing of a message and then resending of the message to produce an undesirable effect

An attack on a network equipment can also be a malware attack (virus, worm, bot, etc.)

Network security, in essence, is how to prevent these attacks, minimize their impact and recover from them  by proper mechanisms and services.  

Security mechanisms, services and policies are often classified into three D's. The Three Ds of Security are defense, deterrence, and detection. Defense is the first mode of security since it "reduces the likelihood of security compromise". Access-control mechanisms are defensive control mechanisms. Examples of defensive control mechanisms are firewalls, router access lists, static routes, spam filters, and virus filters. Deterrence is the second mode of security since it "reduces the frequency of security compromises". Examples of deterrent control methods are email messages reminding employees of corporate acceptable security policies, and security awareness programs. Detection is the third mode of security since it detects a crime in progress. Examples of detective control devices are network-based intrusion detection systems and host-based intrusion detection systems.

All these three D's of security should be used together in order to provide comprehensive security.

A security strategy is proactive in nature. It makes up a complete plan for defense, deterrence, and detection. Security tactics are reactive in nature. They are composed of "the day-to-day practices of people and technologies assigned to the protection of assets". Reaching a right balance between strategy and tactics is not easy.

In the rest of the course, we will study threats, vulnerabilities, attacks, security services and mechanisms in more detail from a network perspective.

To get an overall perspective of what network security is, see the OER resource from CISCO entitled, "What is network Security?"

© 2019 University of Maryland Global Campus.