Lesson 13: Implementing Secure Network Applications Flashcards
HyperText Transfer Protocol (HTTP)
- foundation of web technology is the HyperText Transfer Protocol (HTTP)
- HTTP enables clients (typically web browsers) to request resources from an HTTP server
- client connects to the HTTP server using an appropriate TCP port (the default is port 80) and submits a request for a resource, using a uniform resource locator (URL)
- server acknowledges the request and responds with the data (or an error message)
HTTP header
response and request formats are defined in an HTTP header
HTTP payload
usually used to serve HTML web pages, which are plain text files with coded tags (HyperText Markup Language) describing how the page should be formatted
HTTP (POST)
features a forms mechanism (POST) whereby a user can submit data from the client to the server. HTTP is a stateless protocol; this means that the server preserves no information about the client during a session
web servers
- Most web servers must allow access to guests (that is, unauthenticated users)
- When a web server is leased, a secure means of uploading files and configuration changes needs to be used (SSH, for example)
- When a web server is connected to a private network, the location of the server should be carefully considered so as not to expose the private network to attack from the public one through the web server
- Use separate accounts to administer servers in the DMZ, and ensure that the accounts do not share credentials with any other accounts on the LAN
- Web servers are typically installed with sample pages (and even scripts) along with help documentation. These samples sometimes contain vulnerabilities and should be removed from a production server
- Logging provides valuable information regarding the use of the website, alerts of any unusual or suspicious behavior, and audit changes made to pages and settings
Secure Sockets Layer (SSL)
developed by Netscape in the 1990s to address the problems with the lack of security in HTTP. SSL proved very popular with the industry
Transport Layer Security (TLS)
developed from SSL and ratified as a standard by IETF. SSL/TLS works as a layer between the application and transport layers of the TCP/IP stack. It is usually used to encrypt TCP connections. It is typically used with the HTTP application (referred to as HTTPS or HTTP Over SSL or HTTP Secure) but can also be used to secure other TCP application protocols, such as Telnet, FTP, NNTP, SMTP, or LDAP
HTTPS
to implement HTTPS, a server is assigned a digital certificate signed by some trusted certificate authority (CA). The certificate proves the identity of the server (assuming that the client trusts the Certificate Authority). The server uses the digital certificate and the SSL/TLS protocol to encrypt communications between it and the client. This means that the communications cannot be read or changed by a third party
SSL/TLS Handshake sub-protocol
- The client makes a connection request (CLIENT_HELLO) listing the highest protocol version, cipher suites, and compression algorithm(s) supported
- The server responds with SERVER_HELLO, selecting the highest protocol version and strongest cipher suite supported by both, and its own randomly generated number (ServerRandom), along with any session information
- If client and server support compatible versions and ciphers, the server sends its X.509 certificate to the client (CERTIFICATE command) followed by the SERVER_DONE command
- The client checks the server’s certificate and if verified, responds with CERTIFICATE_VERIFY. It then performs key exchange or key agreement to select the secret session key for use with the confidentiality cipher, such as AES. This process can be completed using either RSA or Diffie-Hellman. If using RSA, the client generates a pre-master secret, encrypts it using the server’s public key, and sends it to the server
- The server and client then follow the same steps to derive a shared master secret from the pre-master secret and the ClientRandom and ServerRandom values
- Client and server then exchange the CHANGE_CIPHER_SPEC command, to indicate that subsequent communications will be encrypted, and the FINISHED command, which contains a digest of the command exchange that is used to verify that the handshake process has not been tampered with
- Once the session is established, client and server exchange encrypted data in SSL/TLS records, which are placed into transport layer packets for delivery
asymmetric ciphers (key exchange and authentication)
RSA, DSA/DSS, and Diffie-Hellmann
symmetric ciphers (confidentiality)
RC4, RC2, DES, 3DES, IDEA, AES
Hashed Message Authentication Code (HMAC) function
MD5 or SHA
SSL
- still widely used compared to TLS
- not interoperable like TLS
Transport Layer Security
- only ones that are safe to use compared to SSL
- not interoperable like SSL
SSL/TLS accelerator
hardware device with a specialist chipset—Application Specific Integrated Circuit (ASIC)—dedicated to performing these calculations
SSL decryptor, inspector, or interceptor
- type of proxy used to examine encrypted traffic before it enters or leaves the network
- ensures that traffic complies with data policies and that encryption is not being misused, either as a data exfiltration mechanism or to operate a Command & Control (C2) Remote Access Trojan
- SSL decryptor would be positioned at the network edge and implemented as a transparent bridge
- drawback is that the decryptor appliance will be a single point of failure, unless a load balancing and failover system is implemented. Some typical functions of SSL decryptors include:
- Block connections that use weak cipher suites or implementations.
- Block connections that cannot be inspected (for instance, they do not use a standard enterprise certificate).
- Do not inspect authorized traffic that is subject to privacy or compliance regulations.
- Integrate with IDS, DLP, and SIEM to apply security policies and provide effective monitoring and reporting.
subscription services
- Market and financial intelligence and information.
- Security threat intelligence and information.
- Reference and training materials in various formats (ebook and video, for instance).
- Software applications and cloud services paid for by subscription rather than permanent licenses.
File Transfer Protocol (FTP)
- typically configured with several public directories, hosting files, and user accounts. Each user account can be configured with different permissions over files and directories
- most HTTP servers also function as FTP servers, and FTP services, accounts, and directories may be installed and enabled by default when you install a web server. FTP is more efficient compared to file attachments or HTTP file transfer, but has no security mechanisms. All authentication and data transfer are communicated as plain text, meaning that credentials can easily be picked out of any intercepted FTP traffic
Trivial File Transfer Protocol (TFTP)
- connectionless protocol (utilizing UDP port 69) that also provides file transfer services
- does not provide the guaranteed delivery offered by FTP and is therefore only suitable for transferring small files. Also, it only supports reading (GET) and writing (PUT) files, not directory browsing, file deletion, or any of the other features of FTP. An example of the usage for TFTP might be a switch or router automatically downloading configuration files
SSH FTP (SFTP)
addresses the privacy and integrity issues of FTP by encrypting the authentication and data transfer between client and server. In SFTP, a secure link is created between the client and server using Secure Shell (SSH) over TCP port 22. Ordinary FTP commands and data transfer can then be sent over the secure link without risk of eavesdropping or Man-in-the-Middle attacks. This solution requires an SSH server that supports SFTP and SFTP client software
two means of securing FTP is to use the connection security protocol SSL/TLS:
- another means of securing FTP is to use the connection security protocol SSL/TLS. As with SMTP, there are two means of doing this:
- Explicit TLS (FTPES)—use the AUTH TLS command to upgrade an unsecure connection established over port 21 to a secure one. This protects authentication credentials. The data connection for the actual file transfers can also be encrypted (using the PROT command).
- Implicit TLS (FTPS)—negotiate an SSL/TLS tunnel before the exchange of any FTP commands. This mode uses the secure port 990 for the control connection.
Simple Mail Transfer Protocol (SMTP)
specifies how mail is delivered from one system to another. It is a relatively straightforward protocol that makes the connection from the sender’s server to that of the recipient and then transfers the message. The SMTP server of the sender discovers the IP address of the recipient SMTP server using the domain name part of the email address. The SMTP server for the domain is registered in DNS using a Mail Exchanger (MX) record
SMTP configurations use the following ports and secure services
- Port 25—used for message relay (between SMTP servers or Message Transfer Agents [MTA]). If security is required and supported by both servers, the STARTTLS command can be used to set up the secure connection.
- Port 587—used by mail clients (Message Submission Agents [MSA]) to submit messages for delivery by an SMTP server. Servers configured to support port 587 should use STARTTLS and require authentication before message submission.
- Port 465—some providers and mail clients use this port for message submission over implicit TLS (SMTPS), though this usage is now deprecated by standards documentation.
