Institute of Southern Punjab, Multan

Transcription

1 Institute of Southern Punjab, Multan Network Security Brief Introduction Lecture#1 Mazhar Hussain Blog

2 Grading Policy Classification Assignments, Quizzes & Class Behavior 15% Attendance 10% Midterm Exams 25% Final Exam 50% Total 100 % 2

3 Students Agreement The course mission is to educate and provide a solid platform for research and development in the field of Network Security by explaining the related concepts and demonstrating several hacking/security tools. You will not use the newly acquired skills for illegal or malicious attacks and you will not use such tools in an attempt to compromise any computer system, and to indemnify ISP university or the instructor with respect to the use or misuse of these tools, regardless of ethical intent. All the students who register in the course agree to the above mentioned points. 3

4 Few things to Remember!! Attendance will be taken with in 15 minutes at the start of class and marked at the end of semester Students are allowed to enter into class with in 30 minutes at the starting of class Zero tolerance policy on attendance, discipline of class during lectures! Assignments must be submitted on time, no late submissions In case of copied assignment both parties will be awarded zero mark! Presentation, Quizzes, Assignments, Class participation are very important. Don t miss your Quizzes, Presentations, Assignments! 4

5 Reference Books: Books Network Security Bible by Eric Cole, Wiley; 2nd Edition (September 8, 2009) Cryptography and Network Security Principles and Practice (5 th Edition) by William Stallings. Data Communications and Networking written by Behrouz A. Forouzan (4th Edition) Network Security Fundamentals by Gert DeLaet and Gert Schauwers. 5

6 Lecture 1: Brief Introduction Communication Networks Introduction to Network Security Types of Hacker Classes Cryptology 6

7 Communication 7

8 Communication Communication is the exchange of Information from one entity to the other using a Transmission Medium As you can clearly notice, the definition of Data Communication although Simple leaves many questions unanswered:- Exchange?? Information?? Entities?? Medium?? Transmission?? 8

9 Communication When we communicate, we share information Information can be LOCAL or REMOTE LOCAL communication occurs face to face REMOTE communication occurs over a long distance When we refer to COMPUTER SYSTEMS, Data is represented in the form of Binary Units (Bits) in the form of Zeros (0 s) and One s (1 s) Also the entities can most of the times be considered to be COMPUTERS! 9

10 Computer Communication Computer Communication is the exchange of data (in the form of 0 s and 1 s) between two devices (computers) via some form of the transmission medium. Computer communication is considered to be Local if the communicating devices are present in the same building or a similarly restricted geographical area. Computer Communication is considered Remote, if the devices are farther apart. 10

11 Components of Data Communication System Any system is made up of more than one component. Similarly, a data communication system is made up of 5 components as shown in the upcoming figure: 1) Message 2) Sender 3) Receiver 4) Transmission Medium 5) Protocol 11

12 Components of Data Communication System 12

13 Components of Data Communication System 1) Message: The message is the information (data) to be communicated. Popular forms of information include text, numbers, pictures, audio, and video. 2) Sender: The sender is the device that sends the data message. It can be a computer, telephone handset, video camera. 3) Receiver: The receiver is the device that receives the message. It can be a computer, telephone handset, television. 13

14 Components of Data Communication System 4) Transmission Medium: The transmission medium is the physical path by which a message travels from sender to receiver. Some examples of transmission media include twisted-pair wire, coaxial cable, fiber-optic cable, and radio waves. 5) Protocol: A protocol is a set of rules that govern data communications. It represents an agreement between the communicating devices. Without a protocol, two devices may be connected but not communicating, just as a person speaking French cannot be understood by a person who 14 speaks only Japanese.

15 Networks 15

16 Network A network is a set of devices/node two or more than two connected together by communication links. A devices/node can be a computer, printer, or any other device capable of sending and/or receiving data generated by other nodes on the network. Both devices must follow the agreed upon rules Standard to share information between them. 16

17 Network Criteria A network must be able to meet a certain number of criteria. The most important of these are: 1) Performance: Performance can be measured in many ways, including transmit time and response time. Transmit time is the amount of time required for a message to travel from one device to another device. 2) Reliability: In addition to accuracy of delivery, network reliability is measured by the frequency of failure, the time it takes a link to recover from a failure 17

18 Network Criteria 3) Security: Network security issues include protecting data from unauthorized access, protecting data from damage and development, and implementing policies and procedures for recovery from breaches and data losses. 18

19 Introduction to Network Security 19

20 Introduction to Network Security A Class debate On What is Network Security? 20

21 Continued Protection of network from unwanted intruders! 21

22 Continued Importance of Network Security! 22

23 Continued 1996 Indian hackers attack Pakistan government sites. Vladimir Levin stole US $ 10 million from Citibank Muslim hackers attack 598 Danish websites. Yahoo, Google, FBI, CIA, several other well known government websites fall victim. China hacker; 50+ Chinese Gov. websites/day 23

24 24

25 Continued For Fun (31.4%) No reason Specified (14.7%) Political Reasons (11.8%) Patriotism (10.9%) As a challenge (10.8%) Revenge (3.3%) 25

26 Types of Hacker Classes 26

27 Types of Hacker Classes White Hat Hacker: Good guys, ethical hackers who use their hacking skills for defensive purpose Black Hat Hacker: Bad guys, the malicious hackers or crackers who use their skills for illegal or malicious purposes Grey Hat Hacker: May work offensively or defensively depending on the situation 27

28 Hackers (Based on Skill Level) Script Kiddies Computer novices using tools Intermediate Hackers Halfway from script kiddies into elite hackers Elite Hackers Highly skilled experts 28

29 Cryptology 29

30 Cryptology Cryptology is a Greek word meaning hidden, secret Cryptology consists on two concepts: 1. Cryptography 2. Cryptanalysis 30

31 1. Cryptography It is the practice and study of techniques for secure communication in the presence of third parties (called adversaries or intruders) More generally, it is about constructing and analyzing protocols that block adversaries Various aspects in information security such as data confidentiality, data integrity, authentication, and nonrepudiation are central to modern cryptography 31

32 Continued Applications of cryptography include ATM cards, computer passwords, VPN and Secure Shell Cryptography prior to the modern age was effectively synonymous with encryption, the conversion of information from a readable state to apparent nonsense state. The originator of an encrypted message shared the decoding technique needed to recover the original information only with intended recipients, thereby stopping unwanted persons from doing the same 32

33 Continued Confidentiality: This term covers two related concepts 1. Data Confidentiality: Assures that private or confidential information is not made available or disclosed to unauthorized individuals 2. Privacy: Assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed 33

34 Continued Integrity: 1. Data Integrity: Assures that information and programs are changed only in a specified and authorized manner 34

35 Continued Non -Repudiation: In a general sense non-repudiation involves associating actions or changes to a unique individual. For a secure area, for example, it may be desirable to implement a key card access system Non-repudiation would be violated if it were not also a strictly enforced policy to prohibit sharing of the key cards and also to immediately report lost or stolen cards 35

36 Continued Authentication: Authentication begins when a user tries to access information. First, the user must prove his access rights and identity. When logging into a computer, users commonly enter usernames and passwords for authentication purposes 36

37 1. Cryptanalysis Cryptanalysis (from the Greek kryptós, "hidden", and analýein, "to loosen" or "to untie") Cryptanalysis is used to breach cryptographic security systems and gain access to the contents of encrypted messages, even if the cryptographic key is unknown 37

38 Continued Even though the goal has been the same, the methods and techniques of cryptanalysis have changed drastically through the history of cryptography, adapting to increasing cryptographic complexity, ranging from the pen-and-paper methods of the past, to the advanced computerized schemes of the present 38

39 END OF LECTURE 1 39