Security Part

-Software (Maleware)

-Hardware (USB-Sticks)

-Social Engineering

-Pattern (DDOS)

-Structural (Botnets)

A Common Vulnerability and Exposure (CVE) is an existing vulnearbility or exposure in a specific software or hardware version/reversion.

A Common Weakness Enumeration (CWE) is a potential weakness in software or hardware.

• full disclosure

• coordinted disclosure (responsible disclosure)

The finder of the vulnerability publishes all the available information about the vulnerability to everone as soon as possible.

Advantages:

-useres can request patches from vendors

-users can provide an informed risk assessment

-because of user intervention reduced time of exploration

The finder of the vulnerability informs a coordinating authority. This authority informs the vendor, tracks the vendors progress in fixing the vulneability and organizes the publiction of the vulnerability after a successfull fix.

Advantages:

-only vendor knows about the vulnerabilty

-vendors have “time” to fix it

-structured way to report

• Confidentiality

• Integrity

• Availability

The physical address -- which is also called a media access control, or MAC, address -- identifies a device to other devices on the same local network. The internet address -- or IP address -- identifies the device globally. A network packet needs both addresses to get to its destination.

• IPv4 Network Classes (not used anymore)

• Classless Inter Domain Routing (CIDR)

The Maximum Transfer Units is the maximum size in bytes an individual data link layer frame can transfer en bloc.

If an IPv4 packet is received from one data link layer and forwarded to another data link layer with smaller MTU the IPv4 packet has to be split into mulitiple ones.

These packetes will only be recombined at the destination.

Peering is the task of exchanging IPv4 packets for different IP networks between large network operators like hosting companies and Internet Service Providers (ISPs).

• Version (the used IP protocol version)

• header length (total length of the header)

• differentiated services (for quality of service)

• total length (total packet length header + payload)

• identification (uniquely identify a group of fragments)

• DF (do not fragment bit)

• MF (more fragments are coming)

• fragment offset (for ordering IPv4 packets)

• TTL (time to live - number is reduced by every router, if 0 packet is dropped)

• protocol (identifinying the transport layer protocol)

• header checksum (for error correction)

• source address

• destination address

• options (for organizing packet managment)

• payload

The Internet Control Message Protocol is used every time the Internet network layer needs to transmit any information.

Typical application are ping and trace route.

The Dynamic Host Configuration Protocol is an important managment protocol of IPv4 to automatically configure devices already connected to through an Ethernet.

It is a client/server protocol.

• Preventive

  Preventive measures do not mitigate existing threats but try to harden a system against vulnerabilities, which might become a threat in the future. They also increase the resiliance of a system against successful attacks

• Reactive

• Network Policies

• Centralized Authentication

• Firewall

• Demilitarized Zone

• Network Segmentation

• authentication

• authorization

• backup

• cryptographic signing

• encryption

• redundacy

Network security:

Only focuses on the information transmitted through the network.

System security:

Only focuses on the information processed in one system.

Digital subscriber line

Fiber to The Home

Network-Address-Translation

Spoofing is a sophisticated method to circumvent certain authentication methods or more specific identification methods.

Address Resolution Protocol

DNS Poisoning is an attack on the application layer to spoof the identiy of some network service like mail or web server.

Machine-In-The-Middle attacks aupport circumventing the authentication if the attacker controls one infrastructure device between two communicating partners and other security features are not enabled.

In general this threat is a deployment, configuration or awarness problem.

• Addressing

• pathfinding / routing

• fragmentation

For the internet these task are described by:

-Internet Protocol Version 4 (IPv4)

-Internet Protocol Version 6 (IPv6)

Domain Name System

• Multi Factor Authentication

• Awarness training