chapter seventeen

CIS 325: Data Communications 1

Chapter SeventeenChapter Seventeen

Network SecurityNetwork Security


The Need for SecurityThe Need for Security

Increased reliance on data Increased reliance on data communications results in greater communications results in greater vulnerability of data and systemsvulnerability of data and systems

Losses associated with computerized Losses associated with computerized fraud and thefts are much larger than fraud and thefts are much larger than non-computerized fraud and theftnon-computerized fraud and theft– Average bank robbery loss: $3000Average bank robbery loss: $3000– Average computer fraud loss: $300,000Average computer fraud loss: $300,000


Types of Security ThreatsTypes of Security Threats

Disruption, Destruction, & DisasterDisruption, Destruction, & Disaster– VirusesViruses– Hardware, software, operator errorsHardware, software, operator errors– Fires/floods/earthquakesFires/floods/earthquakes

Unauthorized AccessUnauthorized Access– HackersHackers– Disgruntled employeesDisgruntled employees


Passive AttacksPassive Attacks

Primarily listening to trafficPrimarily listening to traffic Auth. Users can eavesdrop on lineAuth. Users can eavesdrop on line Tap into patch panelsTap into patch panels Intercept microwave transmissionsIntercept microwave transmissions Tap lines to phone co.Tap lines to phone co. Capture electromagnetic emissionsCapture electromagnetic emissions Fiber optic prevents most Fiber optic prevents most

opportunitiesopportunities


Active AttacksActive Attacks

Read stored dataRead stored data Modify data in storage or during Modify data in storage or during

transmissiontransmission Disrupt serviceDisrupt service Computer Emergency Response Computer Emergency Response

Team (CERT)Team (CERT) An expensive problemAn expensive problem


Conventional EncryptionConventional Encryption

5 ingredients5 ingredients– plain textplain text– encryption algorithmencryption algorithm– secret keysecret key– ciphertextciphertext– decryption algorithmdecryption algorithm

Needs strong encryption algorithmNeeds strong encryption algorithm Sender and receiver must have same keySender and receiver must have same key


Conventional EncryptionConventional Encryption

How to attack or de-cipherHow to attack or de-cipher– cryptanalysiscryptanalysis– brute forcebrute force

Data Encryption Standard (DES)Data Encryption Standard (DES)– Symmetric (same key to encrypt and Symmetric (same key to encrypt and

decrypt)decrypt)– Uses 64-bit key (100 quadrillion Uses 64-bit key (100 quadrillion

possibilities)possibilities)


Public Key EncryptionPublic Key Encryption

6 ingredients6 ingredients– plain textplain text– encryption algorithmencryption algorithm– public keypublic key– private keyprivate key– ciphertextciphertext– decryption algorithmdecryption algorithm


Public Key EncryptionPublic Key Encryption

Process works regardless of order Process works regardless of order that keys are usedthat keys are used

Many know your public keyMany know your public key Only you know private keyOnly you know private key Keys and algorithm designed so Keys and algorithm designed so

they can’t be figured out even with they can’t be figured out even with one key knownone key known


Public Key ProcessPublic Key Process

You encode msg using rcvrs You encode msg using rcvrs PUBLIC keyPUBLIC key

Only rcvr can decode and read Only rcvr can decode and read with private keywith private key

No one else can read msgNo one else can read msg Anyone with public key can send Anyone with public key can send

msg to that rcvrmsg to that rcvr


Public Key ProcessPublic Key Process

Also can be used for authentication Also can be used for authentication of senderof sender– sender send msg using private keysender send msg using private key– rcvr decodes using public keyrcvr decodes using public key– since only sender knows private key, since only sender knows private key,

that authenticates the senderthat authenticates the sender– however, anyone with public key can however, anyone with public key can

read msg, so no good for secrecyread msg, so no good for secrecy


Encryption ManagementEncryption Management

Link EncryptionLink Encryption– devices to protect path from node to devices to protect path from node to

nodenode– all traffic on path is secureall traffic on path is secure– traffic most be decoded at each node traffic most be decoded at each node

for switchingfor switching– traffic is vulnerable at switchtraffic is vulnerable at switch


Encryption ManagementEncryption Management

End-to-end EncryptionEnd-to-end Encryption– devices at each work stationdevices at each work station– traffic secure on path AND switchestraffic secure on path AND switches– But, switch needs to read control bits, But, switch needs to read control bits,

so only data encryptedso only data encrypted Solution is to use combination of Solution is to use combination of

bothboth


Key DistributionKey Distribution

How to get keys to all partiesHow to get keys to all parties– A physically delivers key to BA physically delivers key to B– 3rd party delivers to A and B3rd party delivers to A and B– A transmits key online to BA transmits key online to B– 3rd party transmits to A and B3rd party transmits to A and B

Key Distribution CenterKey Distribution Center Session key for a single sessionSession key for a single session


Digital SignaturesDigital Signatures

Conventional Key doesn’t support Conventional Key doesn’t support non-repudiationnon-repudiation

Authentication does, but very slow Authentication does, but very slow for big messagesfor big messages

Digital Signature relies on public-Digital Signature relies on public-key and ‘secure hash function’ key and ‘secure hash function’


Digital SignaturesDigital Signatures

Hash Code created by doing some Hash Code created by doing some function on plain textfunction on plain text– like a very fancy frame check like a very fancy frame check

sequencesequence Use private key to encrypt hash code Use private key to encrypt hash code

onlyonly Prevents anyone from modifying Prevents anyone from modifying

messagemessage Provides authentication of senderProvides authentication of sender


Web SecurityWeb Security

ProblemsProblems– Alteration of web pageAlteration of web page– Access to server op sysAccess to server op sys– EavesdroppingEavesdropping– ImpersonationImpersonation

SolutionsSolutions– Secure web site serverSecure web site server– Secure site accessSecure site access

chapter seventeen

Documents

data encryptedsolution

key knowncis

data communicationsthe

data communications

greater vulnerability

public keysince

rcvrs public keyonly

private keyrcvr