Section 27 - Security Protocols Flashcards
What does S/MIME stand for?
Secure/Multipurpose Internet Mail Extensions
What is S/MIME?
This is a standard that provides cryptographic security for electronic messaging, things like email.
*** This is built into most email clients that you use
S/MIME uses ___ session keys for each email message that’s being sent or received.
separate
We can use digital IDs within Outlook or digital signatures within many different programs to give our emails authentication, integrity, and non-repudiation through ___.
S/MIME
S/MIME is a way that we can encrypt our emails and their content. The problem with that is…?
It also encrypts all of their contents, including malware.
What is “SSL”?
Secure Socket Layer
This was a way to start securing the web as we wanted to start doing ecommerce.
*** This is a cryptographic protocol that provided secure internet communications for web browsing, IM, email, VoIP, etc. It was last updated in 1996 at version three so you shouldn’t use it. It was replaced with TLS.
What is “TLS”?
Transport Layer Security
*** This is the newer cryptographic protocol that provided secure internet communications. The current version in use is 1.3.
Often times when it comes to SSL and TLS, you’ll find that people will…?
Call it SSL even if it’s TLS that you’re using
How does TLS and SSL work?
The web browser goes out and gets the server’s public key. It, then, takes that and encrypts a random string of numbers, sends that over to the web server. Once the server gets it, they decrypt it using their private key. They will then create a symmetric tunnel between the two. That tunnel, is SSL or TLS.
How does TLS work in conjunction with HTTPS?
If you want to run a secure website, you would tunnel the normal HTTP protocol through a TLS tunnel. Normally you would use HTTP over port 80 but when you tunnel it through SSL or TLS, you’re going to end up putting it on port 443, which is secure HTTP or HTTPS.
For an email, you’d use SMTP and send it over port 25. But if you want to do it securely, you establish a TLS tunnel first. That would establish a TLS tunnel over port 465 instead and your SMTP traffic would go through that tunnel.
You apply this process to IM, file transfer and other stuff.
What is a way that people can attack TLS?
Downgrade attack
What is a “downgrade attack”?
When a protocol is tricked into using a lower quality version instead of using the higher quality version that it was supposed to.
*** Using a weaker (lower quality) protocol makes it easier to be exploited.
What does it mean to do a “break and inspect”?
As a defender of a network, it can be challenging when people use TLS connections because you can’t see what’s going on inside that tunnel. So, with break and inspect, you act as a man-in-the-middle by putting a proxy there. This requires the TLS tunnel to connect to the proxy to be inspected prior to getting to its destination.
What is SSH?
Secure Shell
This is a protocol used to tunnel other protocols through.
This creates a secure channel between two computers or network devices and allows one device to control another device.
This was designed to replace Telnet.
*** For example, if you wanted to use your laptop to connect to a server to do remote execution of commands as a system admin, you would use SSH to do that.
Why was SSH designed to replace Telnet?
Telnet sends everything in the clear and unencrypted
SSH, on the other hand, allows us to have an encrypted tunnel that protects our data.
