1 - Introduction

Question 1

What is Network Security?

Define Security, Security Threat and Security Attack

Answer 1

Security:
- the state of being free from danger or threat

Security Threat:
- a potential violation of security

Security Attack:
- Attempt to gain unauthorized access to a service, resource, or information, or to compromise integrity, availability, or confidentiality
(Note that success is not necessary! )

Question 2

Passive vs Active attacks

Answer 2

Passive attacks

• Eavesdropping: secretly listening to a conversation
• Traffic Analysis: the inference of information from observation of traffic flows

Active attacks

• Spoofing (Masquerading): the pretence by an entity to be a different entity
• Denial of Service (DoS): prevention or inhibition of the normal use or management of communication facilities

Question 3

How to get our network free from Security threats?

Answer 3

Using security Services and Mechanism:

Security Services:
- a service provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers

Security Mechanism:
- a mechanism that is designed to detect, prevent, or recover from a security attack

Question 4

What are the Security Services?

Answer 4

• Authentication
• Access Control
• Confidentiality
• Integrity
• Non-repudiation
• Availability

Question 5

Authentication

Answer 5

• The corroboration that the source of data received or the peer entitiy in association is the one claimed.
• Who am I talking with? Who created this information?

Question 6

Access Control

Answer 6

• The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner.
• Who is allowed to access resources?

Question 7

Confidentiality

Answer 7

• The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
• Who is able to read information?

Question 8

Integrity

Answer 8

• The property that data has not been altered or destroyed in an unauthorized manner.
• Is this the original information? Have I received everything?

Question 9

Non-repudiation

Answer 9

• The property that the denial by one of the entities involved in a communication of having participated in all or part of the communication is not possible.
• Has Bob really sent or received this information?

Question 10

Availability

Answer 10

• The property of being accessible and useable upon demand by an authorized entity.
• Can I use the system whenever I want?

Question 11

How to attack each security services?

Answer 11

Authentication
- IP spoofing, cracking passwords

Access Control
- wire-tapping, breaking authentication

Confidentiality
- eavesdropping, traffic analysis

Integrity
- man-in-the-middle attack, replay attack

Non-repudiation
- deletion of log files, masquerading

Availability
- denial of service attacks