Skip to content

ACtE0506 Network security

Security objectives and services

Category Meaning Examples
Confidentiality Prevent unauthorized disclosure Encryption
Integrity Prevent unauthorized modification Hash, MAC, signature
Availability Keep services accessible Redundancy, DoS resistance
Authentication Verify identity Passwords, certificates
Non-repudiation Prevent denial of origin Digital signatures

These are security objectives or services, not mutually exclusive “types” of security. A practical domain classification is:

  • physical security;
  • endpoint or host security;
  • network security;
  • application security;
  • data or information security;
  • operational security.

The classification depends on the source, so identify the basis used rather than treating one list as universal.

Attack classification cues:

  • Passive attack: eavesdropping, traffic analysis.
  • Active attack: modification, spoofing, replay, denial of service.
  • Malware, phishing, spoofing, man-in-the-middle, and DoS are recurring security terms.

Principles of cryptography

Type Key idea Cue
Symmetric Same shared key for encryption and decryption Fast bulk encryption
Asymmetric Public and private key pair Key exchange, signatures
Hash function One-way digest Integrity checking

RSA essentials

  • RSA is an asymmetric public-key cryptosystem.
  • Public key encrypts or verifies; private key decrypts or signs.
  • Security depends on the hardness of factoring large composite integers.

Decisive signature logic:

  1. Sender computes message digest.
  2. Sender signs the digest with the private key.
  3. Receiver verifies with the sender's public key.
  4. Successful verification gives origin authentication and integrity, not secrecy by itself.

Trap:

  • Encrypting with the public key provides confidentiality for the private-key holder.
  • Signing with the private key provides authenticity and non-repudiation when verified by the public key.

Digital signatures

  • Digital signatures do not usually sign the entire long message directly in exam explanations; they sign a digest.
  • Signature verifies origin and integrity.
  • Signature alone does not hide the message unless encryption is also used.

Securing e-mail: PGP

  • PGP stands for Pretty Good Privacy.
  • It combines public-key and symmetric-key techniques.
  • Common high-level workflow: encrypt message data with a one-time symmetric session key, then protect that session key with the recipient's public key.
  • Signatures can be added for authenticity.

Securing TCP connections: SSL and TLS

  • SSL is the historical name; TLS is the modern standard family.
  • For current correctness, write "SSL/TLS" only when referring historically, but treat TLS as the current secure transport protocol.
  • HTTPS uses TLS to secure HTTP over TCP.

Network-layer security: IPsec and VPN

Item Key fact
IPsec Security suite at IP layer
AH Authentication and integrity; no payload confidentiality
ESP Confidentiality plus optional integrity/authentication
VPN Creates protected tunnel across untrusted network

IPsec cues:

  • Transport mode protects payload of IP packet.
  • Tunnel mode encapsulates the entire original IP packet and is common in site-to-site VPNs.
  • IKEv2 authenticates peers and negotiates IPsec Security Associations and keying material.
  • AH or ESP protects packets; IKE does not itself encrypt the application payload.

Wireless LAN security

  • WEP is obsolete and insecure.
  • WEP was the original IEEE 802.11 confidentiality mechanism; it is now cryptographically broken and obsolete.
  • Major weakness: weak IV handling and flawed key-stream reuse properties.
  • WPA2 and WPA3 are modern secure WLAN approaches compared with WEP.
  • If an MCQ asks whether WEP is recommended today, the answer should be no.

Firewalls

Type Decision basis
Packet-filtering firewall Header fields such as IP, port, protocol
Stateful firewall Tracks connection state
Application proxy firewall Inspects application-layer traffic

Firewall cue:

  • A firewall enforces traffic-control policy between trust zones.
  • It is preventive or filtering control, not encryption by itself.

Security examples

  1. If authenticity is asked, think signature verification with public key against a private-key-created signature.
  2. If confidentiality over the web is asked, HTTPS uses TLS over TCP.
  3. If the wireless option lists WEP versus WPA2, WEP is the obsolete insecure choice.

ACtE0506 revision box

  • Security goals: confidentiality, integrity, availability, authentication, non-repudiation.
  • RSA: public key encrypts/verifies; private key decrypts/signs.
  • Signature gives integrity plus origin authentication, not secrecy.
  • SSL is historical; TLS is current.
  • IPsec works at network layer; VPN often uses tunnel protection.
  • WEP is obsolete and insecure.