Securing TCP/IP Flashcards
5 areas of TCP/IP Security
Encryption - scramble, mix up or change data
Integrity - data is received is the same as data sent
nonrepudiation - person can not deny they took a specific action
authentication - verify person accessing data
authroization - what can authorized person do with data
symmetric-key algorithm
same key for both encryption and decryption
asymmetric-key algorithm
different key for encryption and decryption
block cipehers
name of most symmetric key algorithms
- encrypt chunks of data of a certain length at a time
DES
Data Encryption Standard
64 bit block
56 bit key
susceptible to brute-force attacks
stream ciphers
takes a single bit and encrypts it on the fly
RC4
Rivest Cipher 4
- fast easy to use and free
- stream cipher
AES
Advanced Encryption Standards
- block cipher
- 128, 192 or 256 bit key size
public-key cryptography
primary asymmetric key algorithm
encryption at each layer
1 - no encryption at this layer except bigger WAN tech like SONET
2 - no encryption done at this layer
3 - only IPSec, typically software that encrypts the IP packet, new outer layer encapsulates and encrypts inner packet
4 - neither TCP or UDP offers any encryption
5, 6, 7 - important encryption standards such as SSL and TSL
hash
mathmatical function that you run on a string of binary digits of any length that results in a value of some fixed length (often called a checksum or message digest)
cyptographic hash
- one way function
- hash is irreversible
- can be used to verify file integrity
md5
message-digest algorithm version 5
- 128-bit message digest
SHA
secure hash algorithm
- includes sha-1, sha-2, and sha-3
- sha-1 produces 160-bit message digest
- sha-2 has four variants
- sha-224 (224 bit message digest)
- sha-256
- sha-384
- sha-512
- sha-3 comes in 4 variants
- sha3-224
- sha3-256
- sha3-384
- sha3-512
CRAM-MD5
tool for server authentication
digital signature
a hash of the public key encrypted by the private key
certificate
standardized type of file that includes a public key with a digital signatuure, and the digital signature of a trusted 3rd party
NAC
Network Access Control
- usually prevents computers lacking anti-malware and patches from accessing the network
- creates policies that define what individiual systems can do on the network
ACL
Access Control List
- clearly defined list of permissions that specifies what an authenticated user may perform on a shared resource
- three ACL models: mandatory, discretionary and role based
Mandatory Access Control
MAC
- every resource is assigned a label that defines it security level
- if user lacks level, they don’t get access
- used in OS to determine what programs have access to other programs stored in RAM
Discretionary Access Control
DAC
- resource owner controls access
Role-based Access Control
RBAC
- managed by groups
PPP
Point-to-Point Protocol
- enables to PPP devices to connnect, authenticate with a user/pass and netgotiate network protocol to use
- two methods of authentication, PAP and CHAP
PAP
Password Authentication Protocol
- PPP protocol that simply transmits the user/pass in plaintext
CHAP
Challenge Handshake Authentication Protocol
- PPP protocol relies on a shared secret, usually a password that both ends of the connection knows
- client creates a hash of password, sends to host
- host compares has to password
- periodically repeats the entire process to prevent man-in-the-middle attacks
Microsft CHAP
MS-CHAPv2
- most common authentication method for dialup connections
- offers most security
AAA
Authentication, Authorization, and Accounting
- port authentication
- alooows remote users authentication to a particular point of entry (port) to another network
RADIUS
Remote Authentication Dial-In User Service
- created to support ISPs with thousands of modems to connect to a central database
- consists of 3 devices
- server that has access to a database of usernames and passwords
- number of Network Access Servers (NASs) that control themodems
- and a group of systems that in some way connect ot the network
RADIUS server programs
IAS - Internet Authentication Service for MS Server
FreeRADIUS - Unix/Linux
RADIUS ports
UDP port 1812 and 1813
UDP 1645 and 1646
TACACS+
Terminal Access Controller Access Control SYstem Plus
- created by cisco to support AAA in a network with many routers and switches
- very similar to RADIUS but uses port 49 by default
- separates AAA into 3 parts
- uses PAP, CHAP and MD5, but can use Kerberos
Kerberos
an authentication protocol for TCP/IP networks with many clients all connected to a single authenticating server, no PPP
- used in MS domains
- uses UDP or TCP port 88
- KDC (key distribution center) has two process
- Authentication Server (AS)
- Ticket-granting Service (TGS)
- token includes Security Identifier (SID) plus SIDs for groups the user is a member of
- uses timestamps
- if KDC goes down, no one has access
- timestamps require everyones clocks are synced
Single-sign On
ability to log in only one time and use the same token to access any resource
SSH
Secure Shell
- use PKI in the form of an RSA key
tunnel
secure links between tow programs on separate computers
SSL
Secure Sockets LAyer
- requires server with certificate
- uses symmetic-key cipher
- creates encrypted tunnel between SSL server and client
TLS
Transport Layer Security
- upgrade to SSL
- works with almost any application
IPsec
internet Protocol Security
- works at internet/network layer
- dominant encryption suite
- works in transport mode and tunnel mode
- transport - only payload of packet is encrypted
- tunnel - entire packet is encrypted and placed inside another packet
CRLs
Certificate Revocation Lists
- third party that tracks if certs have been revoked
SCP
Secure Copy Protocol
- transfer data securely between two hosts using SSH
SFTP
replacement for FTP
- uses FTP over SSH
- TCP port 23
SNMP
Simple Network Management Protocol
- queries state of SNMP capable devices
- uses agents (special client programs) to collect network information from a management information base (MIB)
- v1 & v2 unencrypted
- v3 encrypted
LDAP
Lightweight Directory Access Protocol
- tool that programs use to query aqnd change a database used by the network
- can talk to Active Directory and other directory service providers to query and change items
uses TCP and UDP port 389
LDAPS
- secure version of LDAP
- now depricated
used TCP port 636
NTP
Network Time Protocol
- gives current time
In PKI wihch key encrypts the data
public
In order to have PKI, you must have
root authority
