3.1 Implement secure protocols

Question 1

What is SRTP ?

Answer 1

Secure Real Time Protocol (or Secure RTP) use AES to encrypt the conversation over voice/video flow

Question 2

What is NTP & NTPsec ?

Answer 2

• Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems
• NTPsec: NTP secure version

Question 3

What is S/MIME ?

Answer 3

Secure/ Multipurpose Internet Mail Extensions is a public key encryption mechanism that allows to protect the information using encryption and to provide digital signatures for integrity. It require PKI in place in order to manage these keys

Question 4

What is Secure POP and Secure IMAP ?

Answer 4

It use a STARTTLS extension to encrypt POP3 with SSL or use IMAP with SSL

Question 5

What is MIME protocol?

Answer 5

Multipurpose Internet Mail Extensions is an extension of the original Simple Mail Transport Protocol (SMTP) email protocol. It lets users exchange different kinds of data files, including audio, video, images and application programs, over email.

Question 6

What are POP and IMAP protocol?

Answer 6

• POP: post office protocol is the most commonly used message request protocol in the Internet world for transferring messages from an e-mail server to an e-mail client. With POP3, the e-mail client requests new messages from the e-mail server, and the server “pops” all new messages out to the client.
• IMAP: POP3 downloads emails from a server to a single computer, making those emails only accessible on that specific computer. IMAP stores emails on a server and then syncs them across multiple devices. IMAP is more advanced than POP3 and allows you to access your email from anywhere, and on any device.

Question 7

What is the difference between POP and SMTP ?

Answer 7

SMTP (“Simple Mail Transfer Protocol”) is used for sending and delivering from a client to a server via port 25: it’s the outgoing server. On the contrary, POP (“Post Office Protocol”) allows the user to pick up the message and download it into his own inbox: it’s the incoming server.

Question 8

What is web protocol to make it secure ?

Answer 8

SSL/TLS which is use with HTTP protocol (HTTPS). It uses public key encryption methods and use public and private key paired in order to transfer symmetric key across the network so that a session key can then be used symmetrically during the communication

Question 9

What is IPsec ?

Answer 9

Security for OSI Layer 3 and provide authentication and encryption for every packet.
It also provide packet signing for integrity and anti replay features.
IPsec use 2 protocols for its implementation

Question 10

What are the 2 protocols used to implement IPsec ?

Answer 10

• Authentication Header (AH) which provides the integrity
• Encapsulation Security Payload (ESP) that provides the encryption

Question 11

What is FTPS and SFTP ?

Answer 11

• FTPS: FTP over SSL (FTP-SLL), it uses SSL to provide the encryption
• SFTP: SSH File Transfer Protocol and use SSH to provide the encryption. SFTP also provide file system functionality such as resuming interrupted transfers, directory listings, remote file removal

Question 12

What is LDAP & LDAPS ?

Answer 12

• Lightweight Directory Access Protocol is a protocol for reading and writing directories over an IP network. It is used in Windows Active Directory, Apple OpenDirectory, Open LDAP etc
• LDAPS: LDAP over SSL

Question 13

What is SASL ?

Answer 13

Simple Authentication and Security Layer provides authentication using many different methods (i.e Kerberos or client certificate)

Question 14

What is SSH ?

Answer 14

Secure Shell encrypt terminal communication and replaces Telnet (and FTP)

Question 15

What is Domain name resolution ?

Answer 15

DNS had no security in the original design making it an easy target for attackers. To fix this DNSSEC was created and it validate DNS responses to provide the origin of the authentication to the DNS and data integrity. This is allow thanks to public key cryptography: hence DNS records are signed w/ trusted 3rd party

Question 16

How to connect securely to switches and routers?

Answer 16

By using SSH or SNMPv3 (Simple Network Managment Protocol version 3) which provide confidentiality (encrypted data), integrity (no tempering of data), authentication (verifies the source)

Question 17

How to secure network adress allocation?

Answer 17

Network address are allocated using the DHCP protocol which do not include any built-in security. To enhance the security of DHCP, an additional control outside the DHCP protocol was added using for example with the Active Directory, switches that allow DHCP from trusted interfaces.