ACtE0506 Network security¶
Security objectives and services¶
| Category | Meaning | Examples |
|---|---|---|
| Confidentiality | Prevent unauthorized disclosure | Encryption |
| Integrity | Prevent unauthorized modification | Hash, MAC, signature |
| Availability | Keep services accessible | Redundancy, DoS resistance |
| Authentication | Verify identity | Passwords, certificates |
| Non-repudiation | Prevent denial of origin | Digital signatures |
These are security objectives or services, not mutually exclusive “types” of security. A practical domain classification is:
- physical security;
- endpoint or host security;
- network security;
- application security;
- data or information security;
- operational security.
The classification depends on the source, so identify the basis used rather than treating one list as universal.
Attack classification cues:
- Passive attack: eavesdropping, traffic analysis.
- Active attack: modification, spoofing, replay, denial of service.
- Malware, phishing, spoofing, man-in-the-middle, and DoS are recurring security terms.
Principles of cryptography¶
| Type | Key idea | Cue |
|---|---|---|
| Symmetric | Same shared key for encryption and decryption | Fast bulk encryption |
| Asymmetric | Public and private key pair | Key exchange, signatures |
| Hash function | One-way digest | Integrity checking |
RSA essentials¶
- RSA is an asymmetric public-key cryptosystem.
- Public key encrypts or verifies; private key decrypts or signs.
- Security depends on the hardness of factoring large composite integers.
Decisive signature logic:
- Sender computes message digest.
- Sender signs the digest with the private key.
- Receiver verifies with the sender's public key.
- Successful verification gives origin authentication and integrity, not secrecy by itself.
Trap:
- Encrypting with the public key provides confidentiality for the private-key holder.
- Signing with the private key provides authenticity and non-repudiation when verified by the public key.
Digital signatures¶
- Digital signatures do not usually sign the entire long message directly in exam explanations; they sign a digest.
- Signature verifies origin and integrity.
- Signature alone does not hide the message unless encryption is also used.
Securing e-mail: PGP¶
- PGP stands for Pretty Good Privacy.
- It combines public-key and symmetric-key techniques.
- Common high-level workflow: encrypt message data with a one-time symmetric session key, then protect that session key with the recipient's public key.
- Signatures can be added for authenticity.
Securing TCP connections: SSL and TLS¶
- SSL is the historical name; TLS is the modern standard family.
- For current correctness, write "SSL/TLS" only when referring historically, but treat TLS as the current secure transport protocol.
- HTTPS uses TLS to secure HTTP over TCP.
Network-layer security: IPsec and VPN¶
| Item | Key fact |
|---|---|
| IPsec | Security suite at IP layer |
| AH | Authentication and integrity; no payload confidentiality |
| ESP | Confidentiality plus optional integrity/authentication |
| VPN | Creates protected tunnel across untrusted network |
IPsec cues:
- Transport mode protects payload of IP packet.
- Tunnel mode encapsulates the entire original IP packet and is common in site-to-site VPNs.
- IKEv2 authenticates peers and negotiates IPsec Security Associations and keying material.
- AH or ESP protects packets; IKE does not itself encrypt the application payload.
Wireless LAN security¶
- WEP is obsolete and insecure.
- WEP was the original IEEE 802.11 confidentiality mechanism; it is now cryptographically broken and obsolete.
- Major weakness: weak IV handling and flawed key-stream reuse properties.
- WPA2 and WPA3 are modern secure WLAN approaches compared with WEP.
- If an MCQ asks whether WEP is recommended today, the answer should be no.
Firewalls¶
| Type | Decision basis |
|---|---|
| Packet-filtering firewall | Header fields such as IP, port, protocol |
| Stateful firewall | Tracks connection state |
| Application proxy firewall | Inspects application-layer traffic |
Firewall cue:
- A firewall enforces traffic-control policy between trust zones.
- It is preventive or filtering control, not encryption by itself.
Security examples¶
- If authenticity is asked, think signature verification with public key against a private-key-created signature.
- If confidentiality over the web is asked, HTTPS uses TLS over TCP.
- If the wireless option lists WEP versus WPA2, WEP is the obsolete insecure choice.
ACtE0506 revision box¶
- Security goals: confidentiality, integrity, availability, authentication, non-repudiation.
- RSA: public key encrypts/verifies; private key decrypts/signs.
- Signature gives integrity plus origin authentication, not secrecy.
- SSL is historical; TLS is current.
- IPsec works at network layer; VPN often uses tunnel protection.
- WEP is obsolete and insecure.