lecture 6 - Network Security Fundamentals.pptx

CCY2001
Introduction to Cybersecurity
Dr. Mohamed Elhamahmy
Week Five
Saturday 22/Mar/2025, Sun 23/Mar/2025
Tuesday 25/Mar/2025

Network Protocols and Vulnerabilities
Network Security Fundamentals
Intrusion Detection and Prevention Systems (IDPS)
Firewall Technologies
Anti-Malware
Security Information and Event Management (SIEM)
Integrated Security Architecture
Measuring Security Effectiveness

The OSI reference model is a seven-layer model that was developed by the International
Standards Organization (ISO) in 1978. The OSI model is a framework for international
standards that can be used for implementing a heterogeneous computer network
architecture. The OSI architecture is split into seven layers.

TCP/IP model is also a layered reference model, but it is a four-layer model. Another name
for it is Internet protocol suite. It is commonly known as TCP/IP because the foundational
protocols are TCP and IP, but not only these two protocols are used in this model.

 Vulnerable to SYN flooding attacks where
attackers send numerous SYN packets
without completing handshakes
TCP (Transmission Control Protocol)
 Connection-oriented protocol that
ensures reliable data delivery
 Uses a three-way handshake (SYN, SYN-
ACK, ACK) to establish connections

IP (Internet Protocol)
 Responsible for addressing and routing packets
 IPv4 (32-bit addressing) and IPv6 (128-bit addressing)
 Vulnerable to IP spoofing where attackers forge source addresses
UDP (User Datagram Protocol)
 Connectionless protocol with no reliability mechanisms
 Faster than TCP but without delivery guarantees
 Often exploited in amplification DDoS attacks

Application Layer Protocols
SMTP, POP3, IMAP
 Email protocols
 Common vectors for phishing and spam
 Often targeted for credential harvesting
HTTP/HTTPS
 Web communication protocols
 HTTPS adds TLS/SSL encryption
 Vulnerabilities include man-in-the-middle attacks, SSL stripping

Application Layer Protocols
SMTP, POP3, IMAP
 Email protocols
 Common vectors for phishing and spam
 Often targeted for credential harvesting

Intrusion Detection and Prevention Systems (IDPS)

A firewall is a network security device designed to monitor, filter, and
control incoming and outgoing network traffic based on predetermined
security rules. The primary purpose of a firewall is to establish a barrier
between a trusted internal network and untrusted external networks.

Packet filtering firewall is used to control network access by monitoring outgoing and
incoming packets and allowing them to pass or stop based on source and destination IP
address, protocols, and ports. It analyses traffic at the transport protocol layer (but mainly
uses first 3 layers). Packet filtering firewall maintains a filtering table that decides whether
the packet will be forwarded or discarded according to rules.

Rule: Allow incoming traffic on port 80 (HTTP) from any source.
Syntax (iptables-style):
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
Explanation:
-A INPUT: Add rule to the incoming traffic chain.
-p tcp: Protocol is TCP.
--dport 80: Destination port is 80 (HTTP).
-j ACCEPT: Accept the matching traffic.
Rule: Block all incoming traffic from IP 192.168.1.100.
Syntax:
iptables -A INPUT -s 192.168.1.100 -j DROP
Explanation:
-s 192.168.1.100: Source IP address to match.
-j DROP: Silently discard the traffic (no response sent).

Stateful firewalls (performs Stateful Packet Inspection) are able to determine the
connection state of packet, unlike Packet filtering firewall, which makes it more efficient. It
keeps track of the state of networks connection travelling across it, such as TCP streams. So
the filtering decisions would not only be based on defined rules, but also on packet’s
history in the state table.

Stateful firewall rules differ from stateless rules in that they track the state of network
connections (e.g., whether a connection is new, established, or related) rather than just
inspecting individual packets in isolation.
Rule: Allow incoming traffic for connections that are already established or related (e.g.,
responses to outgoing requests).
Syntax (iptables):
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Explanation:
-m state: Use the state-matching module.
--state ESTABLISHED,RELATED: Match packets part of existing connections or related to
them (e.g., FTP data channels).
-j ACCEPT: Accept the traffic.
Use Case: Ensures responses to your outgoing requests (like web browsing) are allowed.

NGFW consists of Deep Packet Inspection, Application Inspection, SSL/SSH inspection and
many functionalities to protect the network from these modern threats.
Next Generation Firewall

A software firewall is any firewall that is set up locally or on a cloud server. When it comes
to controlling the inflow and outflow of data packets and limiting the number of networks
that can be linked to a single device, they may be the most advantageous. But the problem
with software firewall is they are time-consuming.

They also go by the name “firewalls based on physical appliances.” It guarantees that the
malicious data is halted before it reaches the network endpoint that is in danger.
These are software-based, cloud-deployed network devices. This cloud-based firewall
protects a private network from any unwanted access. Unlike traditional firewalls, a cloud
firewall filters data at the cloud level.

Parental Controls: Parents can use firewalls to block their children from accessing explicit
web content.
Once a malicious person finds your network, they can easily access and threaten it,
especially with constant internet connections. Using a firewall is essential for proactive
protection against these risks. It helps users shield their networks from the worst dangers.
A firewall serves as a security barrier for a network, narrowing the attack surface to a
single point of contact. Instead of every device on a network being exposed to the
internet, all traffic must first go through the firewall.
Infiltration by Malicious Actors: Firewalls can block suspicious connections, preventing
eavesdropping and advanced persistent threats (APTs)
Workplace Web Browsing Restrictions: Employers can restrict employees from using the
company network to access certain services and websites, like social media.
Nationally Controlled Intranet: Governments can block access to certain web
content and services that conflict with national policies or values.

A Security Information And Event Management (SIEM) solution supports threat detection,
compliance and security incident management through the collection and analysis (both
near real-time and historical) of security events, as well as a wide variety of other event
and contextual data sources.

The first-generation SIM technology was built on top of traditional log collection
management systems. SIM introduced long-term storage analysis, and reporting on log
data, and combined logs with threat intelligence.
The second-generation SEM technology addressed security events, aggregation,
correlation, and notification for events from security systems such as antivirus, firewalls,
and Intrusion Detection Systems (IDS), as well as events reported directly by
authentication, SNMP traps, servers, and databases.
A few years following, vendors introduced a combination of the SIM and SEM to create
the SIEM, hence a new definition per Gartner’s research.

A SIEM solution works by collecting data from various sources such as computers,
network devices, servers, and more.
The data is then normalized and aggregated. Next, security professionals analyze the
data to discover and detect threats.
As a result, businesses can pinpoint security breaches and enable organizations to
investigate alerts.
To best understand how the SIEM works, let’s first take a closer look at two key security
concepts: incidents and events.

Unified Security Management
 Centralized policy administration
 Consistent security posture
 Reduced administrative overhead
Tool Integration Examples
 Firewall + IPS integration for context-aware blocking
 Anti-malware + SIEM for outbreak detection
 Identity management + firewalls for user-based access control
Security Orchestration and Automation
 Security Orchestration, Automation and Response (SOAR)
 Automated incident response workflows
 Integration with ticketing and case management

Mean time to detect (MTTD): It refers to how long it takes for the organization to identify a
production problem—such as a system outage. So, you naturally want to keep this metric as
low as possible since that would mean your organization is quick to discover issues and,
consequently, fix them.
Security Metrics

Mean time to respond (MTTR): It is an indicator of maintainability (how easily a piece of
equipment can be repaired). A higher Mean Time to Repair may indicate that replacing a
given asset is cheaper or preferable to repairing it. On the other hand, a lower MTTR may
suggest “run-to-failure” is not the worst option for that asset.
Security Metrics

Testing and Validation
Penetration testing

lecture 6 - Network Security Fundamentals.pptx

lecture 6 - Network Security Fundamentals.pptx

More Related Content

Similar to lecture 6 - Network Security Fundamentals.pptx

Recently uploaded

lecture 6 - Network Security Fundamentals.pptx