Module 3

3.1 E-Mail Security: Pretty Good Privacy (PGP)

Pretty Good Privacy (PGP) is one of the most widely used protocols for securing email
communications. Developed by Phil Zimmermann in 1991, PGP uses cryptographic techniques
to ensure confidentiality, integrity, and authenticity of email content.

1. What is PGP?

 PGP is a data encryption and decryption program that provides cryptographic privacy
and authentication for email and file transfers. It uses a combination of symmetric and
asymmetric encryption techniques.
 The name "Pretty Good Privacy" reflects its objective—to provide a strong yet
accessible encryption tool for individuals and organizations.

2. Core Functions of PGP

 Confidentiality: Ensures that only the intended recipient can read the content by
encrypting the message using the recipient's public key.
 Authentication and Integrity: Uses digital signatures to verify that the message was
sent by the claimed sender and was not tampered with during transmission.

3. Encryption and Decryption Process

 The sender encrypts the message using a random session key (symmetric encryption),
which is itself encrypted using the recipient’s public key (asymmetric encryption).
 The recipient decrypts the session key using their private key, and then uses the session
key to decrypt the message content.

4. Digital Signature Mechanism

 The sender creates a message digest (hash) of the original message using a hashing
algorithm (e.g., SHA-256).
 This digest is then encrypted with the sender’s private key, forming the digital
signature, which is sent along with the message to ensure authenticity.

5. PGP Key Management

 Each user has a key pair (public and private). The public key is shared openly, while
the private key is kept secure.
 PGP does not rely on a centralized certificate authority (CA) but instead uses a web of
trust, where users manually validate each other’s public keys.
6. Security Advantages of PGP

 Provides end-to-end encryption, making it extremely difficult for intermediaries to

intercept or alter the message.
 Combines the speed of symmetric encryption with the security of asymmetric
encryption, making it both efficient and secure.

7. Limitations of PGP

 Key management and manual verification can be complex for non-technical users,
limiting its widespread adoption.
 If a private key is lost or compromised, previously encrypted messages become
inaccessible or vulnerable.

8. Common Use Cases

 Used in secure email communications, especially in corporate, legal, and political

environments where message privacy is critical.
 Also applied in digital file encryption, secure backups, and software signing to verify
file origin and authenticity.

9. Software and Tools Supporting PGP

 GnuPG (GPG) is a free and open-source implementation of PGP, widely adopted for
Linux and other platforms.
 Popular email clients like Mozilla Thunderbird support PGP through add-ons such as
Enigmail or built-in OpenPGP features.
3.2 S/MIME and IP Security: Overview of IP Security (IPSec)

Digital communication today is highly vulnerable to cyberattacks, especially over unsecured

networks like the internet. Two critical security technologies help protect such
communications: S/MIME, which secures email, and IPSec, which secures data at the network
layer. This section focuses on the IP Security (IPSec) overview, while referencing the
relationship to S/MIME.

1. Introduction to IP Security (IPSec)

 IPSec (Internet Protocol Security) is a suite of protocols designed to secure IP

communications by authenticating and encrypting each IP packet of a communication
session.
 It works at the network layer (Layer 3) of the OSI model, providing end-to-end
security across all applications without requiring changes to individual software.

2. Objectives of IPSec

 Confidentiality: Ensures that data cannot be read by unauthorized users through strong
encryption (e.g., AES).
 Integrity: Ensures that data has not been tampered with during transmission using hash
functions like HMAC-SHA.
 Authentication: Verifies the identity of the communicating parties through
mechanisms like pre-shared keys or digital certificates.
 Anti-Replay Protection: Prevents attackers from resending captured packets to gain
unauthorized access.

3. Core Protocols of IPSec

 Authentication Header (AH): Provides authentication and integrity for IP packets

but does not encrypt the content.
 Encapsulating Security Payload (ESP): Provides encryption, along with
authentication and integrity for IP packets.
 Both AH and ESP can operate in two modes: Transport Mode and Tunnel Mode.

4. IPSec Modes of Operation

 Transport Mode: Only the data portion of each IP packet is encrypted or authenticated.
It is typically used in end-to-end communication between two hosts.
 Tunnel Mode: Entire IP packet is encapsulated and protected. Commonly used in
VPNs to secure communication between gateways or between a client and gateway.

5. IPSec Key Management – IKE Protocol

 Internet Key Exchange (IKE) is used to establish and manage Security Associations
(SAs) for IPSec.
 It automates key negotiation, mutual authentication, and SA creation between two
parties.

6. IPSec Security Associations (SAs)

  An SA is a set of policies and keys used to secure traffic between devices.
 Each direction of communication requires a separate SA, defined by parameters like
encryption algorithm, keys, and lifetime.

7. Advantages of IPSec

 Application Independence: Protects all traffic regardless of the application or service,

unlike S/MIME which is limited to email.
 Interoperability: IPSec is supported by most modern operating systems and
networking equipment.
 Transparent Protection: Users don't need to interact with IPSec; it's implemented at
the OS or network device level.

8. Limitations of IPSec

 Configuration Complexity: Requires in-depth knowledge of networking and

encryption standards to configure properly.
 Performance Overhead: Encryption and decryption add computational load, which
can affect network speed.
 Compatibility Issues: Not all applications or firewalls handle IPSec traffic well,
particularly in NAT environments.
2.3 IP Security Architecture (IPSec Architecture)

IP Security (IPSec) is a suite of protocols designed to secure IP communications by providing

data confidentiality, integrity, and authentication at the network layer. Its architecture includes
multiple components—protocols, key management systems, and modes of operation—that
work together to create secure communication channels.

1. Overview of IPSec Architecture

 The IPSec architecture defines how data can be securely transmitted over an IP network
by applying encryption and authentication services to IP packets.
 IPSec operates in peer-to-peer, gateway-to-gateway, or host-to-gateway
environments, and can protect both IPv4 and IPv6 traffic.

2. Major Components of IPSec Architecture

a. Security Protocols: AH and ESP

 Authentication Header (AH): Provides integrity and authentication for IP packets. It

does not offer encryption.
 Encapsulating Security Payload (ESP): Offers encryption (confidentiality), along
with optional authentication and integrity services.

b. Security Associations (SA)

 A Security Association is a unidirectional agreement between two entities that defines

how data will be secured.
 Each SA includes cryptographic algorithms, keys, lifetime, and other parameters. SAs
are stored in the Security Association Database (SAD).

c. Internet Key Exchange (IKE)

 IKE is used to negotiate and manage SAs between peers, automatically handling key
generation, authentication, and exchange.
 Operates in two phases:
o Phase 1: Establishes a secure IKE SA.
o Phase 2: Negotiates IPSec SAs using the IKE SA.

d. Security Policy Database (SPD)

 The SPD defines rules for processing outbound and inbound traffic, such as:
o What kind of traffic should be protected.
o What security protocols and keys should be applied.
 Each incoming or outgoing packet is compared against SPD policies to determine the
appropriate IPSec action.

3. Modes of Operation
a. Transport Mode

 Only the payload (data) of the IP packet is encrypted/authenticated.

 Used for end-to-end communication (e.g., host-to-host).

b. Tunnel Mode

 The entire IP packet (header + payload) is encapsulated within a new IP packet.

 Commonly used in VPNs for site-to-site or remote access security.

4. Cryptographic Algorithms in IPSec

 Encryption: AES, 3DES (for confidentiality)

 Integrity: HMAC with SHA-1, SHA-2 (for data integrity)
 Authentication: Digital certificates, RSA, ECDSA, or pre-shared keys (for identity
verification)

5. IPSec Packet Processing

 Outbound Traffic: The IPSec module consults the SPD → determines applicable SA
→ encrypts and/or authenticates the packet → sends it.
 Inbound Traffic: The IPSec module verifies the packet’s SA → decrypts/authenticates
it → passes it to the IP layer.

6. IPSec Deployment Scenarios

 Host-to-Host: Direct communication between two devices with IPSec enabled.

 Gateway-to-Gateway: Used in VPNs to secure traffic between two networks via IPSec
routers or firewalls.
 Host-to-Gateway: Remote user connects securely to a corporate network, often used
in remote access VPNs.
2.4 Authentication Header (AH) – In IPSec

The Authentication Header (AH) is a core protocol within the IPSec suite that provides data
integrity, origin authentication, and anti-replay protection for IP packets. Unlike ESP
(Encapsulating Security Payload), AH does not offer confidentiality (i.e., it does not encrypt
the data).

1. Purpose of the Authentication Header

 The primary goal of AH is to verify the integrity and authenticity of IP packets using
cryptographic hash functions.
 It ensures that data has not been altered during transit and that the packet truly
originated from the claimed sender.

2. Key Features of AH

 Integrity Check: AH uses a hash-based message authentication code (HMAC) to

detect any tampering with the packet data.
 Sender Authentication: Verifies the identity of the sender through shared secrets or
digital signatures.
 No Encryption: AH does not hide the contents of the packet; the payload remains
visible to anyone intercepting the traffic.

3. Operation Modes of AH

 Transport Mode: Only the IP payload (the upper-layer data) is authenticated. The
original IP header is largely retained, but some mutable fields are excluded from the
integrity check.
 Tunnel Mode: The entire original IP packet (header + payload) is encapsulated and
authenticated. A new IP header is added outside the AH.
5. How AH Works

 When a sender transmits a packet:

o A hash (Integrity Check Value) is calculated over immutable parts of the IP
header and the entire payload using a shared key.
o This hash is stored in the Authentication Data field of the AH.
 On receipt, the receiver performs the same calculation and compares the hashes. If
they match, the packet is authenticated.

6. Fields Authenticated by AH

 AH protects most of the IP header fields except mutable fields like:

o Time To Live (TTL)
o Header Checksum
o Fields modified in transit (e.g., IP fragmentation)

7. Benefits of Using AH

 Strong Integrity: Guarantees that the packet content hasn't been modified en route.
 Source Verification: Authenticates the packet origin, helping to prevent IP spoofing.
 Anti-Replay: Sequence numbers ensure each packet is unique and hasn't been resent
by an attacker.

8. Limitations of AH

 No Encryption: Sensitive data remains exposed; AH is not suitable when

confidentiality is required.
 NAT Incompatibility: AH authenticates IP headers; if NAT changes any part of the IP
header, the verification will fail.
 Limited Use Cases: ESP is often preferred over AH, as ESP can provide both
encryption and optional authentication.
2.5 Encapsulating Security Payload (ESP) – In IPSec

The Encapsulating Security Payload (ESP) is a core component of the IP Security (IPSec)
protocol suite. Unlike the Authentication Header (AH), which provides only integrity and
authentication, ESP provides confidentiality through encryption, and optionally,
authentication and integrity. It is the most widely used IPSec protocol today, especially in
VPNs.

1. Purpose of ESP

 Confidentiality: ESP encrypts the payload of IP packets, making them unreadable to

unauthorized entities during transmission.
 Optional Authentication: ESP can also authenticate the payload and IP header (in
tunnel mode), ensuring that the packet originates from a trusted source and has not been
modified.

2. Services Provided by ESP

 Encryption: Uses symmetric encryption algorithms like AES, 3DES to protect payload
data.
 Data Integrity: Uses cryptographic hash functions (HMAC-SHA1, HMAC-SHA2) to
ensure the message was not altered in transit.
 Authentication: Verifies the identity of the sender (if enabled).
 Anti-Replay Protection: Protects against packet replay attacks using a sequence
number mechanism.

3. Modes of Operation

a. Transport Mode

 Only the transport-layer payload (e.g., TCP/UDP + data) is encrypted and optionally
authenticated.
 The original IP header is left intact, making it suitable for end-to-end communication
between hosts.

b. Tunnel Mode

 The entire original IP packet (header + payload) is encrypted and encapsulated

within a new IP packet.
 A new IP header is added, making it ideal for VPNs or site-to-site connections
between gateways.
5. How ESP Works

 The sender encrypts the payload using a symmetric encryption algorithm with a session
key negotiated during the IKE (Internet Key Exchange) process.
 The ESP header is added before the encrypted payload, and the entire packet may
include an optional authentication trailer.
 The receiver uses the SPI to find the correct Security Association, decrypts the data,
and verifies its authenticity (if enabled).

6. Advantages of ESP

 Comprehensive Protection: Offers both encryption and optional authentication.

 NAT Compatibility: Works with NAT environments using NAT-T (NAT Traversal).
 Flexible Modes: Can secure end-to-end host traffic (transport) or gateway tunnels
(tunnel).

7. Limitations of ESP

 No Full Header Authentication: Unlike AH, ESP does not authenticate all fields of
the IP header in transport mode.
 Optional Authentication: If not enabled, ESP can be used solely for encryption, which
might leave the packet open to certain spoofing or replay attacks.
2.6 Internet Key Exchange (IKE)

Internet Key Exchange (IKE) is a protocol used within the IPSec suite to establish secure and
authenticated communication channels between two parties. IKE manages the negotiation of
cryptographic keys, Security Associations (SAs), and encryption/authentication
parameters, playing a central role in IPSec-based Virtual Private Networks (VPNs).

1. Purpose of IKE

 IKE automates the process of key exchange and SA negotiation between IPSec peers,
eliminating the need for manual configuration.
 It ensures that cryptographic keys and IPSec policies are securely exchanged using a
combination of Diffie–Hellman key exchange, digital certificates, and/or pre-shared
keys (PSK).

2. Working Layers of IKE

 IKE operates in the Application Layer but works in close coordination with IPSec
protocols at the Network Layer.
 It typically runs over UDP port 500 and uses the Internet Security Association and Key
Management Protocol (ISAKMP) framework for message formatting and SA
management.

3. IKE Phases Overview

a. IKE Phase 1: Establishing IKE SA

 The two peers authenticate each other and establish a secure, encrypted channel called
the IKE SA.
 It protects further negotiation traffic using encryption and hashing algorithms.
 Two modes are supported in Phase 1:
o Main Mode: More secure; uses 6 messages to negotiate.
o Aggressive Mode: Faster but less secure; uses 3 messages.

b. IKE Phase 2: Negotiating IPSec SA

 The previously established IKE SA is used to negotiate IPSec SAs (for ESP or AH
protocols).
 This phase uses Quick Mode to finalize encryption/authentication protocols, keys, and
lifetimes for IPSec-protected traffic.

4. Key Functions Performed by IKE

 Mutual Authentication: Confirms the identity of each peer using digital certificates,
PSKs, or public keys.
 Key Generation and Exchange: Uses the Diffie–Hellman (DH) algorithm to create a
shared secret key.
 Security Association Negotiation: Agrees on IPSec policies (encryption method, key
lifetimes, etc.).
  Replay Protection Setup: Establishes sequence numbers and anti-replay mechanisms
for IPSec traffic.

6. Cryptographic Elements Used in IKE

 Diffie–Hellman Groups: For generating shared secrets.

 Hash Algorithms: Such as SHA-1 or SHA-2, for integrity checks.
 Encryption Algorithms: AES, 3DES used for encrypting negotiations.
 Authentication: Certificates (X.509), RSA signatures, or PSKs.

7. Security Considerations in IKE

 Key Lifetimes: Keys should be periodically refreshed to avoid compromise.

 Strong Cipher Suites: Outdated or weak algorithms (like MD5, DES) should be
avoided.
 Replay Attacks: Countered by sequence numbers and lifetimes in SAs.
 Man-in-the-Middle (MitM) Resistance: Use of authenticated DH exchange prevents
MitM attacks.

8. Advantages of Using IKE

 Automation: Eliminates manual key configuration and policy negotiation.

 Flexibility: Supports multiple authentication and encryption algorithms.
 Scalability: Used in enterprise VPNs, secure site-to-site tunnels, and mobile clients.
 Interoperability: Works across different vendors' devices using standardized
protocols.

9. Limitations of IKE

 Complex Configuration: Misconfigurations in IKE policies or key exchange settings

can cause connectivity issues.
 Overhead: Initial negotiation adds latency to the start of secure sessions.
 NAT Compatibility: Requires NAT Traversal (NAT-T) mechanisms when behind
NAT gateways, especially for IKEv1.
 Module 4:

4.1 Web Security Considerations

Web security refers to the set of practices and technologies used to protect websites, web
applications, and online services from various cyber threats. As websites are often the first
point of attack, it's critical to implement layered security strategies to ensure confidentiality,
integrity, and availability of data and services.

1. Secure Communication (HTTPS)

 Always use HTTPS (Hypertext Transfer Protocol Secure) instead of HTTP to

encrypt data between the client and server using SSL/TLS protocols.
 HTTPS prevents eavesdropping, man-in-the-middle attacks, and tampering of
information exchanged between browser and server.

2. Input Validation and Output Encoding

 User inputs must be strictly validated to prevent injection attacks (e.g., SQL injection,
command injection).
 Output encoding ensures that user data is safely rendered on the web page, reducing
risks of Cross-Site Scripting (XSS) attacks.

3. Authentication and Authorization

 Implement strong authentication mechanisms, including multifactor authentication

(MFA) for all sensitive operations.
 Use role-based access control (RBAC) or attribute-based access control (ABAC)
to manage permissions and restrict access based on user roles or attributes.

4. Session Management

 Use secure cookies with flags such as HttpOnly, Secure, and SameSite.
 Implement session timeouts and regenerate session IDs after login to prevent session
hijacking and fixation attacks.

5. Secure Password Policies

 Enforce complex password requirements, password expiration, and prevent the use
of weak or compromised passwords.
 Store passwords using salted and hashed formats (e.g., bcrypt, Argon2) instead of
plain text.

6. Protection Against Injection Attacks

 Use prepared statements and parameterized queries when interacting with databases
to prevent SQL injection.
 Avoid concatenating strings from user input directly into queries or system commands.
7. Cross-Site Scripting (XSS) Prevention

 Sanitize user inputs and use context-aware encoding when displaying user-generated
content.
 Apply Content Security Policy (CSP) headers to limit the sources from which scripts
can be loaded.

8. Cross-Site Request Forgery (CSRF) Protection

 Use CSRF tokens for all state-changing requests to ensure that the action was initiated
by the authenticated user.
 Implement the SameSite cookie attribute to control how cookies are sent with cross-
site requests.

9. Secure API Management

 Protect APIs with authentication (OAuth2, API keys) and implement rate limiting
to prevent abuse.
 Validate all input sent to APIs and avoid exposing unnecessary endpoints.

10. Server-Side Security Configurations

 Regularly patch and update web server software and frameworks to eliminate known
vulnerabilities.
 Disable directory listing, unused services, and default configurations to reduce the
attack surface.
 Use web application firewalls (WAFs) to detect and block malicious traffic.

11. Secure File Upload Handling

 Verify uploaded file type, size, and content, and rename files to avoid execution as
scripts.
 Store uploaded files outside the web root and scan them with antivirus tools before
processing.

12. Logging and Monitoring

 Implement centralized logging of access and error events for auditing and incident
response.
 Set up real-time monitoring and alerting systems to detect abnormal behaviors or
intrusion attempts.

13. Regular Security Testing

 Conduct regular vulnerability assessments, penetration testing, and code reviews.

 Use automated tools for static application security testing (SAST) and dynamic
application security testing (DAST).

14. Data Protection and Privacy Compliance

 Ensure compliance with regulations such as GDPR, CCPA, or India’s Digital
Personal Data Protection Act.
 Implement data minimization, secure data storage, and user consent mechanisms.
4.2 Secure Socket Layer (SSL) and Transport Layer Security (TLS)

Secure Socket Layer (SSL) and Transport Layer Security (TLS) are cryptographic
protocols designed to provide secure communication over the Internet. They protect data by
ensuring confidentiality, integrity, and authentication between clients and servers —
especially in web services like HTTPS, email, and instant messaging.

1. Introduction to SSL and TLS

 SSL (developed by Netscape in the mid-1990s) was the original protocol designed to
secure online communications. It has been deprecated due to known vulnerabilities.
 TLS (Transport Layer Security) is the successor to SSL. It provides stronger security
and is the current standard for secure communication on the web.
 TLS is often still referred to as "SSL" in common usage, but in practice, SSL 2.0 and
3.0 are obsolete and insecure.

2. Objectives of SSL/TLS

 Confidentiality: Ensures that transmitted data is encrypted and unreadable to third

parties.
 Integrity: Detects and prevents data tampering during transit using cryptographic hash
functions.
 Authentication: Verifies the identity of the server (and optionally the client) using
digital certificates.

3. SSL/TLS Protocol Stack Integration

 TLS operates between the application layer (e.g., HTTP, SMTP) and the transport
layer (TCP) in the OSI model.
 It acts as a security wrapper around application protocols to secure client-server data
exchanges.

4. TLS/SSL Handshake Process

This process establishes a secure connection between a client and a server.

Key Steps:

 Client Hello: The client sends a list of supported cipher suites, TLS versions, and a
random number.
 Server Hello: The server selects the cipher suite, sends its certificate (for
authentication), and its random number.
 Key Exchange: Both parties use the Diffie–Hellman or RSA algorithm to agree on a
shared session key.
 Session Key Generation: A symmetric session key is derived and used for encrypting
actual communication.
 Finished: Both client and server confirm that the handshake is successful and start
secure communication.

5. Cryptographic Components Used

  Symmetric Encryption: AES, ChaCha20 (for encrypting session data).
 Asymmetric Encryption: RSA, ECDSA (used during handshake to exchange keys and
verify identities).
 Hashing Algorithms: SHA-256, SHA-384 (for message integrity).
 Certificates: X.509 digital certificates issued by Certificate Authorities (CAs) to
authenticate websites.

7. SSL/TLS in Real-World Applications

 Web Browsing (HTTPS): Uses TLS to secure traffic between browsers and web
servers.
 Email Protocols: POP3S, IMAPS, and SMTPS use TLS to secure email transmission.
 VPNs and VoIP: TLS is used for secure signaling and encryption.

8. Security Benefits of TLS over SSL

 TLS provides stronger encryption algorithms, faster performance, and improved

protection against modern threats.
 Unlike SSL, TLS supports forward secrecy, ensuring that even if session keys are
compromised, past communications remain secure.

9. Attacks on SSL/TLS (Historical and Current)

 POODLE Attack: Exploits SSL 3.0’s fallback mechanism.

 BEAST and CRIME Attacks: Exploit vulnerabilities in SSL/TLS implementations.
 Certificate Spoofing: Fake CAs or stolen certificates may be used in MitM attacks.
 TLS Stripping: Downgrades HTTPS to HTTP during client-server interaction.
4.3 HTTPS (Hypertext Transfer Protocol Secure)

HTTPS is the secure version of HTTP, used for safe communication between a client (like a
web browser) and a server (like a website). It integrates HTTP with Transport Layer Security
(TLS) to provide encrypted and authenticated communication, making it fundamental for
modern web security.

1. What is HTTPS?

 HTTPS (Hypertext Transfer Protocol Secure) is an internet communication protocol

that ensures data confidentiality, integrity, and authentication.
 It wraps regular HTTP traffic inside a secure TLS (or SSL) tunnel to encrypt data in
transit, preventing unauthorized access.

2. Why HTTPS is Needed

 Plain HTTP transmits data in clear text, exposing it to eavesdropping, tampering, or

impersonation.
 HTTPS is essential for:
o Protecting user privacy
o Securing login credentials, financial data, and personal information
o Ensuring trust in e-commerce, banking, and government websites

3. Key Components of HTTPS

a. TLS/SSL Protocol

 Provides encryption, authentication, and data integrity.

 Secures the connection between browser and server.

b. X.509 Digital Certificates

 Issued by Certificate Authorities (CAs) to authenticate the website’s identity.

 Helps the browser ensure that the server is genuine and not impersonated.

4. How HTTPS Works – Connection Process

a. Client Hello

 Browser sends supported TLS versions, cipher suites, and a random number.

b. Server Hello

 Server replies with chosen cipher suite, its certificate, and another random number.

c. Certificate Validation

 Browser checks the server’s certificate against a list of trusted CAs.

d. Key Exchange

 A shared session key is derived using Diffie-Hellman or similar algorithm.

e. Secure Session

 After handshake, data is encrypted using the session key.

5. Benefits of HTTPS

 Confidentiality: Data is encrypted during transit, preventing eavesdropping.

 Integrity: Protects data from being altered using cryptographic hash functions.
 Authentication: Server’s certificate confirms the site’s legitimacy.
 Trust Indicator: Browsers show a lock icon 🔒 to indicate a secure HTTPS
connection.
 SEO Boost: Search engines like Google prioritize HTTPS sites in rankings.

6. HTTPS vs HTTP

Feature HTTP HTTPS

Encryption ❌ No ✅ Yes (via TLS/SSL)

Data Integrity ❌ No ✅ Ensured

Authentication ❌ No ✅ Uses digital certificates

Browser Indicator ❌ No Lock Icon ✅ Lock Icon + "Secure" Message

SEO Ranking Neutral Improved Ranking

7. Common HTTPS Use Cases

 E-commerce Websites: Protects credit card and payment information.

 Login Pages: Encrypts usernames, passwords, and sessions.
 Online Banking: Secures financial data and transactions.
 Email Services: Encrypts web-based email sessions.
 APIs and Mobile Apps: Secures data exchanged over REST APIs.

8. Certificate Authorities and SSL Certificates

 CAs (Certificate Authorities) issue SSL/TLS certificates to website owners.

 Types of Certificates:
o Domain Validated (DV): Basic validation of domain ownership.
o Organization Validated (OV): Validates organization identity.
o Extended Validation (EV): Highest level of validation, shows company name
in browser.
4.4 Secure Shell (SSH)

Secure Shell (SSH) is a cryptographic network protocol that enables secure remote access
and control of devices over unsecured networks. It provides strong authentication,
encryption, and integrity for managing servers, network devices, and systems remotely,
making it a fundamental tool in cybersecurity and system administration.

1. What is SSH?

 SSH stands for Secure Shell, a protocol used to establish a secure connection between
a client and a server over an untrusted network.
 It replaces older, insecure remote access protocols like Telnet, rlogin, and FTP by
encrypting all traffic, including passwords and command outputs.

2. Key Features of SSH

 Confidentiality: Encrypts all transmitted data to prevent eavesdropping.

 Integrity: Ensures data has not been altered in transit.
 Authentication: Verifies both server and client identity using passwords, public key
pairs, or certificates.
 Port Forwarding: Enables secure tunneling of other protocols (e.g., HTTP, VNC).
 File Transfer Support: Includes tools like SCP and SFTP for secure file transfers.

3. Components of SSH Architecture

a. SSH Client

 The software or terminal used to initiate a connection to the remote server.

 Common tools: ssh command-line utility on Unix-like systems, PuTTY on Windows.

b. SSH Server

 Runs on the host system being accessed remotely (usually using sshd daemon).
 Listens on port 22 by default.

c. SSH Protocol Layers

 Transport Layer Protocol: Provides encryption and integrity protection.

 User Authentication Protocol: Handles client authentication (password, key-based,
etc.).
 Connection Protocol: Supports multiple sessions over a single connection (remote
shell, port forwarding, file transfer).

4. SSH Authentication Methods

a. Password Authentication

 The user authenticates by typing a password.

 Less secure due to susceptibility to brute-force attacks.
b. Public Key Authentication

 Based on asymmetric encryption using a public-private key pair.

 The private key remains on the client; the public key is stored on the server.
 Offers higher security and is widely used in automation and scripting.

c. Certificate-Based Authentication

 Uses digital certificates signed by a trusted Certificate Authority (CA).

 Suitable for large-scale enterprise environments.

5. SSH Key-Based Authentication Process

1. Key Generation: The user generates a public-private key pair.

2. Public Key Deployment: The public key is placed in the server’s
~/.ssh/authorized_keys file.
3. Connection Establishment: The server challenges the client using the public key.
4. Private Key Verification: The client proves ownership of the private key, granting
access.

6. SSH Security Features

 End-to-End Encryption: Protects data from interception or tampering.

 Host Verification: Clients store known server fingerprints in known_hosts to prevent
man-in-the-middle attacks.
 Session Timeout: Inactive sessions are terminated to prevent misuse.
 Login Restrictions: SSH can be configured to limit access by IP, port, or user.

7. SSH Use Cases

 Remote Server Management: System administrators use SSH to monitor and maintain
Linux/Unix servers.
 Secure File Transfers: Tools like SCP (Secure Copy Protocol) and SFTP (SSH File
Transfer Protocol) use SSH for encrypted data exchange.
 Automated Scripts: SSH enables remote task execution in DevOps and CI/CD
pipelines.
 Tunneling: SSH tunnels can encrypt other protocols like HTTP or database traffic.
8. Common SSH Commands
Command Description

ssh user@host Connect to a remote host

ssh -i key.pem user@host Connect using a private key file

scp file user@host:/path Copy file to a remote server

sftp user@host Start an SFTP session

ssh -L 8080:localhost:80 host Create a local tunnel to remote HTTP service

4.5 Wireless Network Security: Wireless Security

Wireless network security refers to the set of protocols, policies, and measures designed to
protect wireless networks and communication from unauthorized access, data theft, and
cyber threats. Unlike wired networks, wireless systems transmit data through radio waves,
making them more vulnerable to eavesdropping and intrusion if not properly secured.

1. Introduction to Wireless Security

 Wireless communication provides flexibility and mobility but introduces significant

security challenges due to its broadcast nature.
 Devices such as laptops, smartphones, IoT devices, and access points (APs)
communicate over radio frequencies that can be easily intercepted without adequate
protection.
 Wireless security involves authentication, encryption, and access control
mechanisms to ensure safe data transmission.

2. Common Threats to Wireless Networks

 Eavesdropping: Attackers intercept unencrypted wireless traffic using tools like

Wireshark.
 Rogue Access Points: Fake APs mimic legitimate networks to lure users and steal
credentials.
 Man-in-the-Middle (MitM) Attacks: Attackers intercept communication between
users and legitimate access points.
 Denial of Service (DoS): Attackers flood the network or jam signals to make the
wireless service unavailable.
 Session Hijacking: Unauthorized users hijack valid sessions and gain access to
sensitive information.

3. Security Protocols for Wireless Networks

a. WEP (Wired Equivalent Privacy)

 Introduced with IEEE 802.11.

 Uses RC4 stream cipher with static keys.
 Highly insecure and deprecated due to vulnerabilities such as weak key management
and predictable IVs (Initialization Vectors).

b. WPA (Wi-Fi Protected Access)

 Introduced to fix WEP's flaws.

 Uses TKIP (Temporal Key Integrity Protocol) with dynamic key generation.
 Improved over WEP but still has known weaknesses.

c. WPA2

 Based on the IEEE 802.11i standard.

  Uses AES (Advanced Encryption Standard) and CCMP (Counter Mode with
Cipher Block Chaining Message Authentication Code Protocol).
 Considered secure for most applications until WPA3.

d. WPA3

 Latest and most secure wireless standard.

 Uses Simultaneous Authentication of Equals (SAE) instead of PSK.
 Resistant to offline brute-force attacks and provides forward secrecy.
 Includes 192-bit security for enterprise-grade deployments.

4. Authentication Mechanisms

 Pre-Shared Key (PSK): Used in WPA/WPA2 Personal mode, where all devices share
a common password.
 802.1X / EAP (Extensible Authentication Protocol): Enterprise mode authentication
using RADIUS servers for user-based access control.
 MAC Address Filtering: Allows only approved MAC addresses to connect (easily
spoofed and not secure on its own).

5. Encryption Techniques

 RC4 (used in WEP/TKIP): Deprecated due to vulnerabilities.

 AES (used in WPA2/WPA3): Modern and robust symmetric encryption standard.
 CCMP: Provides encryption and message integrity using AES in WPA2/WPA3.

6. Wireless Network Security Best Practices

 Always use WPA2 or WPA3; avoid WEP or open networks.

 Set strong, complex passwords for wireless access points.
 Change default SSID and administrative credentials.
 Enable MAC filtering and network segmentation for better control.
 Disable SSID broadcasting if not needed, to reduce visibility.
 Regularly monitor wireless traffic for suspicious activity using tools like Kismet or
Aircrack-ng.
 Use VPNs on public Wi-Fi networks to encrypt traffic end-to-end.
 Limit the signal range to prevent unauthorized users from connecting from outside.
7. Advanced Wireless Security Concepts

 Wireless Intrusion Detection Systems (WIDS): Monitor for rogue access points and
anomalous behavior.
 Wireless Intrusion Prevention Systems (WIPS): Automatically block or contain
threats in real-time.
 Geofencing and RF Shielding: Control wireless access based on physical location.
 Device Certificates: Used in enterprise networks for strong identity validation.

8. Enterprise Wireless Security

 Implement RADIUS servers with EAP-TLS for strong, certificate-based

authentication.
 Use VLAN segmentation to isolate guest traffic from internal networks.
 Regularly audit wireless infrastructure and rotate encryption keys.
 Deploy mobile device management (MDM) to enforce wireless security policies on
connected devices.
4.6 IEEE 802.11 Wireless LAN

The IEEE 802.11 standard defines the set of protocols used for implementing Wireless Local
Area Networks (WLANs). It governs the physical and data link layers of the OSI model,
enabling wireless communication between devices like laptops, smartphones, routers, and
access points. The term “Wi-Fi” is commonly used to refer to wireless networking based on
these standards.

1. Introduction to IEEE 802.11

 IEEE 802.11 is a standard developed by the Institute of Electrical and Electronics

Engineers (IEEE) to define wireless networking behavior and interoperability.
 It specifies how data is transmitted over the air, how devices identify each other,
and how security and access control are enforced.
 It is the backbone for Wi-Fi technology, which operates typically in the 2.4 GHz and
5 GHz bands.

2. Components of an IEEE 802.11 Wireless LAN

a. Wireless Station (STA)

 A device with wireless capability (e.g., smartphones, laptops).

 Each STA includes a wireless network interface card (NIC).

b. Access Point (AP)

 Acts as a bridge between wireless clients and the wired network.

 Provides connectivity, access control, and signal broadcasting.

c. Basic Service Set (BSS)

 A group of STAs that communicate with one AP.

 Identified by a unique BSSID (MAC address of the AP).

d. Extended Service Set (ESS)

 A set of interconnected BSSs (multiple APs) with the same SSID (network name),
providing wider coverage.

3. IEEE 802.11 Architecture

a. Distribution System (DS)

 Connects multiple APs to form a seamless WLAN.

 Usually part of the wired infrastructure (e.g., Ethernet).

b. Independent BSS (Ad-hoc Mode)

 STAs communicate directly without an AP.

  Used in peer-to-peer wireless setups.

c. Infrastructure Mode

 Most common mode in enterprises and homes.

 STAs connect via an AP to access wired networks and the internet.

4. IEEE 802.11 Protocol Stack

 Operates at the Data Link Layer (Layer 2) and Physical Layer (Layer 1) of the OSI
model.
 Uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) as the
medium access protocol.
 Includes two sublayers:
o MAC (Medium Access Control): Responsible for frame delivery, access
control, and addressing.
o PHY (Physical Layer): Handles modulation, transmission, and reception of
signals.

5. IEEE 802.11 Frame Format

Key Fields in a MAC Frame:

 Frame Control: Type, subtype, flags.

 Duration: Time required for transmission.
 Address Fields: MAC addresses of source, destination, BSSID.
 Sequence Control: Order of frames.
 Payload: Actual data being transferred.
 FCS (Frame Check Sequence): Error checking.
7. Wireless Security in 802.11

 Originally, WEP (Wired Equivalent Privacy) was used, but it is now obsolete.
 WPA, WPA2, and WPA3 offer robust encryption and authentication for 802.11
networks.
 802.11i is the amendment that defines WPA2 (using AES and 802.1X for secure
authentication).

8. Features and Techniques in IEEE 802.11

a. Roaming

 Allows users to move between APs in the same ESS without losing connectivity.

b. Power Management

 Devices can enter sleep modes to save battery while maintaining connectivity.

c. QoS (Quality of Service) – 802.11e

 Provides prioritized traffic handling, important for VoIP and streaming.

d. MIMO (Multiple Input Multiple Output)

 Used in 802.11n/ac/ax for parallel data streams, enhancing throughput.

9. Advantages of IEEE 802.11 WLAN

 Mobility: Users can connect without being tethered by wires.

 Scalability: Easy to add new devices.
 Cost-effective: Reduces cabling and maintenance costs.
 Interoperability: Devices from different manufacturers can communicate if compliant
with IEEE 802.11.

10. Challenges and Considerations

 Interference: From microwaves, Bluetooth, and other wireless devices.

 Security: Needs strong encryption and user authentication.
 Coverage: Signal strength can degrade with obstacles like walls or large distances.
 Bandwidth Sharing: All users on the same AP share available bandwidth.
4.7 IEEE 802.11i – Wireless LAN Security Standard

The IEEE 802.11i amendment to the IEEE 802.11 standard defines enhanced security
mechanisms for Wireless Local Area Networks (WLANs). It was developed in response to
the vulnerabilities found in earlier wireless security protocols like WEP and forms the basis for
Wi-Fi Protected Access 2 (WPA2).

1. Introduction to IEEE 802.11i

 IEEE 802.11i was ratified in 2004 to address severe security flaws in WEP (Wired
Equivalent Privacy).
 It introduces robust encryption and authentication protocols to protect wireless
communications against eavesdropping, tampering, and unauthorized access.
 The technologies specified in 802.11i are implemented in the WPA2 security protocol,
which has been widely adopted.

2. Objectives of 802.11i

 To provide strong data encryption, ensuring confidentiality of data over the air.
 To ensure data integrity, preventing unauthorized modification of packets.
 To enable robust user authentication, verifying the identity of devices before
allowing access.
 To support both enterprise (802.1X) and personal (pre-shared key) authentication
modes.

3. Key Components of IEEE 802.11i

a. Authentication Mechanisms

 Supports two types of authentication:

o Pre-Shared Key (PSK): Used in home or small office setups (WPA2-
Personal).
o 802.1X/EAP Authentication: Enterprise-grade authentication using RADIUS
servers (WPA2-Enterprise).
 Ensures only authorized users can access the WLAN.

b. Robust Security Network Association (RSNA)

 Describes the secure handshake between a wireless client (supplicant) and an access
point (authenticator).
 Involves:
o 4-Way Handshake: Establishes and confirms encryption keys.
o Group Key Handshake: Used to update multicast/broadcast keys.

c. Encryption and Integrity Protocols

 Replaces WEP’s weak RC4 cipher with:

o AES (Advanced Encryption Standard) for encryption.
 o CCMP (Counter Mode with Cipher Block Chaining Message
Authentication Code Protocol) for data integrity and confidentiality.

4. 4-Way Handshake Process

This handshake is critical to establish secure communication between client and AP.

Steps:

1. AP sends ANonce (a random number) to the client.

2. Client generates SNonce, derives the Pairwise Transient Key (PTK), and sends it to
the AP.
3. AP derives the same PTK, verifies it, and sends a group key.
4. Client installs the keys and sends confirmation.

Both client and AP now share symmetric keys used to encrypt and decrypt traffic.

5. Encryption with AES-CCMP

 AES is a symmetric encryption algorithm that is secure and efficient.

 CCMP uses:
o Counter Mode (CTR) for data encryption.
o CBC-MAC (Cipher Block Chaining Message Authentication Code) for
message integrity.
 CCMP ensures data cannot be read or altered by unauthorized parties.

6. WPA2 – Implementation of 802.11i

 WPA2 fully adopts the 802.11i specification.

 Introduced mandatory use of AES-CCMP.
 Provides better resistance to:
o Replay attacks
o Man-in-the-middle attacks
o Key recovery attacks
 WPA2 operates in two modes:
o WPA2-Personal: Uses a shared passphrase.
o WPA2-Enterprise: Uses 802.1X and RADIUS for centralized authentication.

Component Description

Supplicant The client device attempting to connect.

Authenticator The Access Point controlling network access.

Authentication Server Usually a RADIUS server for credential validation.

8. Advantages of 802.11i over Previous Standards

 Stronger Encryption: AES is far superior to RC4 (used in WEP/WPA-TKIP).

 Improved Key Management: Dynamic generation of keys instead of static keys.
 Mutual Authentication: Ensures both client and server are legitimate (in enterprise
setups).
 Protection Against Replay Attacks: Fresh nonce values and sequence numbers are
used.

9. Limitations and Evolution

 Though 802.11i and WPA2 are still widely used, they are vulnerable to:
o Weak passwords (in PSK mode).
o KRACK attacks (Key Reinstallation Attacks) – mitigated with patches.
 To overcome these issues, IEEE 802.11ax (Wi-Fi 6) recommends using WPA3, which
provides:
o Enhanced protection with Simultaneous Authentication of Equals (SAE).
o Forward secrecy, even if long-term keys are compromised.