Information systems 365 lecture eight
Download as PPT, PDF0 likes588 views
The document is a lecture on telecommunications and network security from a course taught at the University of Wisconsin, covering foundational concepts and protocols such as the OSI model, TCP/IP, and different network topologies. It explains various networking devices, including routers and switches, signal types, and how data is transmitted across networks, as well as security protocols and the importance of DHCP in assigning IP addresses. The document also distinguishes between TCP and UDP protocols, outlining their respective characteristics and use cases.
![AA NNoottee AAbboouutt RRoooottkkiittss
A rootkit is a stealthy type of software,
typically malicious, designed to hide the
existence of certain processes or programs
from normal methods of detection and
enable continued privileged access to a
computer.[1] The term rootkit is a
concatenation of "root" (the traditional
name of the privileged account on Unix
operating systems) and the word "kit"
(which refers to the software components
that implement the tool). The term
"rootkit" has negative connotations through
its association with malware.[1]
10/07/14 UNIVERSITY OF WISCONSIN 69](https://image.slidesharecdn.com/informationsystems365lectureeight-141006231433-conversion-gate02/85/Information-systems-365-lecture-eight-69-320.jpg)
Information systems 365 lecture eight
- 1. Information Security 365/765, Fall Semester, 2014 Course Instructor, Nicholas Davis Lecture 8, Telecommunications and Network Security
- 2. TTooddaayy’’ss CChhooccoollaattee BBaarr YYoouurr OOlldd FFrriieenndd SSnniicckkeerrss 10/07/14 UNIVERSITY OF WISCONSIN 2
- 3. TTeelleeccoommmmuunniiccaattiioonnss aanndd NNeettwwoorrkk SSeeccuurriittyy OOvveerrvviieeww The OSI seven layer model TCP/IP and other protocols LAN, WAN, MAN, intranet, extranet Cable types and data transmission types Network devices and services Communications security management Telecommunications devices Remote access methods and technologies Wireless technologies 10/07/14 UNIVERSITY OF WISCONSIN 3
- 4. TThhee OOSSII SSeevveenn LLaayyeerr MMooddeell The Open Systems Interconnection model (OSI) is a conceptual model that characterizes and standardizes the internal functions of a communication system by partitioning it into abstraction layers. The model is a product of the Open Systems Interconnection project at the International Organization for Standardization (ISO) 10/07/14 UNIVERSITY OF WISCONSIN 4
- 5. LLaayyeerr 11:: PPhhyyssiiccaall LLaayyeerr This is the physical stuff connecting computers together (cables, switches, routers, modems etc etc). 10/07/14 UNIVERSITY OF WISCONSIN 5
- 6. LLaayyeerr 22:: DDaattaa LLiinnkk This is where switches operate. 10/07/14 UNIVERSITY OF WISCONSIN 6
- 7. LLaayyeerr 33:: NNeettwwoorrkk This is where routers operate. Anything regarding the TCP/IP protocol happens here. Think IP’s, subnet masks, default gateways etc. 10/07/14 UNIVERSITY OF WISCONSIN 7
- 8. LLaayyeerr 44:: TTrraannssppoorrtt This layer deals how much information is sent back and forth in a session. Using the website example it handles the information the user sends in a request, and then the information the server has to retrieve and send back in order for you to see the website. 10/07/14 UNIVERSITY OF WISCONSIN 8
- 9. LLaayyeerr 55:: SSeessssiioonn This layer deals with communication between two devices. For example: when the user goes to a website, the user’s computer must open a session between itself and server hosting the website, thus allowing the user to receive the website in the first place. The same goes for any sort of communication, ie VOIP etc. 10/07/14 UNIVERSITY OF WISCONSIN 9
- 10. LLaayyeerr 66:: PPrreesseennttaattiioonn This is the OS. 10/07/14 UNIVERSITY OF WISCONSIN 10
- 11. LLaayyeerr 77:: AApppplliiccaattiioonn This is the layer the user is interacting with (software). This can be skype, chrome etc. 10/07/14 UNIVERSITY OF WISCONSIN 11
- 12. IIPP –– IInntteerrnneett PPrroottooccooll HHooww tthhee IInntteerrnneett TTaallkkss A protocol (means of communication) which provides a means for routing data to its destination Think of it this way: Data = A letter IP address = Addressed envelope Network = the postal system 10/07/14 UNIVERSITY OF WISCONSIN 12
- 13. TTCCPP aanndd UUDDPP TTwwoo MMaajjoorr PPrroottooccoollss FFoorr TTrraannssmmiissssiioonn OOvveerr IIPP 10/07/14 UNIVERSITY OF WISCONSIN 13
- 14. RReelliiaabbaaiilliittyy TTCCPP TCP is connection-oriented protocol. When a file or message send it will get delivered unless connections fails. If connection lost, the server will request the lost part. There is no corruption while transferring a message. 10/07/14 UNIVERSITY OF WISCONSIN 14
- 15. RReelliiaabbiilliittyy UUDDPP UDP is connectionless protocol. When you a send a data or message, you don't know if it'll get there, it could get lost on the way. There may be corruption while transferring a message. 10/07/14 UNIVERSITY OF WISCONSIN 15
- 16. OOrrddeerreedd DDeelliivveerryy TTCCPP Ordered: If you send two messages along a connection, one after the other, you know the first message will get there first. You don't have to worry about data arriving in the wrong order 10/07/14 UNIVERSITY OF WISCONSIN 16
- 17. NNoo OOrrddeerreedd DDeelliivveerryy UUDDPP If you send two messages out, you don't know what order they'll arrive in i.e. no ordered 10/07/14 UNIVERSITY OF WISCONSIN 17
- 18. TTCCPP iiss aa HHeeaavvyywweeiigghhtt PPrroottooccooll Heavyweight: - when the low level parts of the TCP "stream" arrive in the wrong order, resend requests have to be sent, and all the out of sequence parts have to be put back together, so requires a bit of work to piece together 10/07/14 UNIVERSITY OF WISCONSIN 18
- 19. UUDDPP iiss aa LLiigghhttwweeiigghhtt PPrroottooccll Lightweight: No ordering of messages, no tracking connections, etc. It's just fire and forget! This means it's a lot quicker, and the network card / OS have to do very little work to translate the data back from the packets. 10/07/14 UNIVERSITY OF WISCONSIN 19
- 20. TTCCPP SSttrreeaammiinngg Streaming: Data is read as a "stream," with nothing distinguishing where one packet ends and another begins. There may be multiple packets per read call. 10/07/14 UNIVERSITY OF WISCONSIN 20
- 21. UUDDPP DDaattaaggrraammss Datagrams: Packets are sent individually and are guaranteed to be whole if they arrive. One packet per one read call. 10/07/14 UNIVERSITY OF WISCONSIN 21
- 22. EExxaammpplleess ooff TTCCPP SSeerrvviicceess Examples: World Wide Web (Apache TCP port 80), e-mail (SMTP TCP port 25 Postfix MTA), File Transfer Protocol (FTP port 21) and Secure Shell (OpenSSH port 22) etc. 10/07/14 UNIVERSITY OF WISCONSIN 22
- 23. EExxaammpplleess ooff UUDDPP SSeerrvviicceess Examples: Domain Name System (DNS UDP port 53), streaming media applications such as IPTV or movies, Voice over IP (VoIP), Trivial File Transfer Protocol (TFTP) and online multiplayer games etc 10/07/14 UNIVERSITY OF WISCONSIN 23
- 24. WWhhaatt iiss YYoouurr OOppiinniioonn ooff WWhheenn ttoo UUssee TTCCPP vvss.. UUDDPP?? TCP is typically slower than UDP UDP is typically less reliable than TCP 10/07/14 UNIVERSITY OF WISCONSIN 24
- 25. TThhee TTCCPP HHaannddsshhaakkee 10/07/14 UNIVERSITY OF WISCONSIN 25
- 26. EEvveerryy NNooddee oonn aann IIPP NNeettwwoorrkk HHaass aann IIPP AAddddrreessss In IPv4 there are five classes of IP addresses A-E Class A = Very large networks Class B = Medium to large size networks Class C = Small networks Class D = Reserved for multicasting Class E = Experimental and educational use 10/07/14 UNIVERSITY OF WISCONSIN 26
- 27. BBaasseebbaanndd vvss BBrrooaaddbbaanndd CCoommmmuunniiccaattiioonn Baseband uses the entire bandwidth of a communication channel for its transmission Broadband divides the available bandwidth into individual channels, each carrying independent data streams 10/07/14 UNIVERSITY OF WISCONSIN 27
- 28. TThhee 55 TTyyppeess ooff PPhhyyssiiccaall NNeettwwoorrkk TTooppoollooggiieess Bus Ring Star Tree Mesh 10/07/14 UNIVERSITY OF WISCONSIN 28
- 29. BBuuss TTooppoollooggyy Bus networks (not to be confused with the system bus of a computer) use a common backbone to connect all devices. A single cable, the backbone functions as a shared communication medium that devices attach or tap into with an interface connector. A device wanting to communicate with another device on the network sends a broadcast message onto the wire that all other devices see, but only the intended recipient actually accepts and processes the message. 10/07/14 UNIVERSITY OF WISCONSIN 29
- 30. Ring Topology In a ring network, every device has exactly two neighbors for communication purposes. All messages travel through a ring in the same direction (either "clockwise" or "counterclockwise"). A failure in any cable or device breaks the loop and can take down the entire network. 10/07/14 UNIVERSITY OF WISCONSIN 30
- 31. Star Topology Many home networks use the star topology. A star network features a central connection point called a "hub node" that may be a network hub , switch or router . Devices typically connect to the hub with Unshielded Twisted Pair (UTP) Ethernet. Compared to the bus topology, a star network generally requires more cable, but a failure in any star network cable will only take down one computer's network access and not the entire LAN. (If the hub fails, however, the entire network also fails.) 10/07/14 UNIVERSITY OF WISCONSIN 31
- 32. TTrreeee TTooppoollooggyy CCoorrppoorraattee NNeettwwoorrkkss Tree topologies integrate multiple star topologies together onto a bus. In its simplest form, only hub devices connect directly to the tree bus, and each hub functions as the root of a tree of devices. This bus/star hybrid approach supports future expandability of the network much better than a bus (limited in the number of devices due to the broadcast traffic it generates) or a star (limited by the number of hub connection points) alone. 10/07/14 UNIVERSITY OF WISCONSIN 32
- 33. MMeesshh TTooppoollooggyy TThhee LLaarrggeerr IInntteerrnneett Mesh topologies involve the concept of routes. Unlike each of the previous topologies, messages sent on a mesh network can take any of several possible paths from source to destination. (Recall that even in a ring, although two cable paths exist, messages can only travel in one direction.) Some WANs , most notably the Internet, employ mesh routing. 10/07/14 UNIVERSITY OF WISCONSIN 33
- 34. SSuummmmaarryy ooff NNeettwwoorrkk TTooppoollooggiieess Topologies remain an important part of network design theory. You can probably build a home or small business computer network without understanding the difference between a bus design and a star design. However, each type of topology has security implications. 10/07/14 UNIVERSITY OF WISCONSIN 34
- 35. NNeettwwoorrkk CCaabblliinngg CCooaaxxiiaall CCaabbllee Coaxial cable, or coax (pronounced 'ko.æks), is a type of cable that has an inner conductor surrounded by a tubular insulating layer, surrounded by a tubular conducting shield. Many coaxial cables also have an insulating outer sheath or jacket. 10/07/14 UNIVERSITY OF WISCONSIN 35
- 36. NNeettwwoorrkk CCaabblliinngg TTwwiisstteedd PPaaiirr Twisted pair cabling is a type of wiring in which two conductors of a single circuit are twisted together for the purposes of canceling out electromagnetic interference from external sources; for instance, electromagnetic radiation from unshielded twisted pair cables, and crosstalk between neighboring pairs. 10/07/14 UNIVERSITY OF WISCONSIN 36
- 37. NNeettwwoorrkk CCaabblliinngg FFiibbeerr OOppttiicc A technology that uses glass (or plastic) threads (fibers) to transmit data. A fiber optic cable consists of a bundle of glass threads, each of which is capable of transmitting messages modulated onto light waves. Fiber optics has several advantages over traditional metal communications lines: 10/07/14 UNIVERSITY OF WISCONSIN 37
- 38. FFoorr BBeetttteerr SSeeccuurriittyy UUssee CCooaaxxiiaall CCaabbllee oorr FFiibbeerr OOppttiiccss Signal leakage from twisted pair cables makes them vulnerable to snooping of the data traffic 10/07/14 UNIVERSITY OF WISCONSIN 38
- 39. BBeewwaarree ooff SSiiggnnaall AAtttteennuuaattiioonn ((lloossss ooff ssiiggnnaall oovveerr ddiissttaannccee)) 10/07/14 UNIVERSITY OF WISCONSIN 39
- 40. AAssssiiggnniinngg AAnn IIPP AAddddrreessss DDHHCCPP Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of numbers (i.e., a scope) configured for a given network. DHCP assigns an IP address when a system is started, for example, your cable modem at home uses DHCP 10/07/14 UNIVERSITY OF WISCONSIN 40
- 41. AAssssiiggnniinngg aann IIPP AAddddrreessss SSttaattiicc If you feel the need to always know what your IP address is then you need a Static IP address, because it is constant. Static IP addresses are used on servers making it easy for all computers to contact them, since they will know what the address of the server is 10/07/14 UNIVERSITY OF WISCONSIN 41
- 42. DDiiffffeerreenntt TTyyppeess ooff NNeettwwoorrkk DDeevviicceess Repeaters Bridges Routers Switches 10/07/14 UNIVERSITY OF WISCONSIN 42
- 43. RReeppeeaatteerr In telecommunications, a repeater is an electronic device that receives a signal and retransmits it at a higher level or higher power, or onto the other side of an obstruction, so that the signal can cover longer distances. 10/07/14 UNIVERSITY OF WISCONSIN 43
- 44. BBrriiddggee A network bridge is a network device that connects multiple network segments. In the OSI model bridging acts in the first two layers, below the network layer. 10/07/14 UNIVERSITY OF WISCONSIN 44
- 45. RRoouutteerr A router is a networking device, commonly specialized hardware, that forwards data packets between computer networks. 10/07/14 UNIVERSITY OF WISCONSIN 45
- 46. NNeettwwoorrkk SSwwiittcchh A network switch (sometimes known as a switching hub) is a computer networking device that is used to connect devices together on a computer network, by using a form of packet switching to forward data to the destination device. 10/07/14 UNIVERSITY OF WISCONSIN 46
- 47. NNeettwwoorrkk GGaatteewwaayy In computer networking, a gateway is a node (a router) on a TCP/IPnetwork that serves as an access point to another network. A defaultgateway is the node on the computer network that the networksoftware uses when an IP address does not match any other routes in the routing table. 10/07/14 UNIVERSITY OF WISCONSIN 47
- 48. FFiirreewwaallll In computing, a firewall is a network security system that controls the incoming and outgoing network traffic based on applied rule set. A firewall establishes a barrier between a trusted, secure internal network and another network (e.g., the Internet) that is not assumed to be secure and trusted. 10/07/14 UNIVERSITY OF WISCONSIN 48
- 49. TThhee TTrriicckkeerryy ooff aa HHoonneeyyppoott A honey pot is a computer system on the Internet that is expressly set up to attract and "trap" people who attempt to penetrate other people's computer systems. You can learn a lot from a Honeypot 10/07/14 UNIVERSITY OF WISCONSIN 49
- 50. NNeettwwoorrkk SSeeggmmeennttaattiioonn Reduced congestion: Improved performance is achieved because on a segmented network there are fewer hosts per subnetwork, thus minimizing local traffic Improved security: Broadcasts will be contained to local network. Internal network structure will not be visible from outside Containing network problems: Limiting the effect of local failures on other parts of network 10/07/14 UNIVERSITY OF WISCONSIN 50
- 51. DDNNSS DDoommaaiinn NNaammiinngg SSeerrvviiccee The DNS translates Internet domain and host names to IP addresses. DNS automatically converts the names we type in our Web browser address bar to the IP addresses of Web servers hosting those sites. DNS implements a distributed database to store this name and address information for all public hosts on the Internet. DNS assumes IP addresses do not change (are statically assigned rather than dynamically assigned). 10/07/14 UNIVERSITY OF WISCONSIN 51
- 52. DDNNSS PPooiissoonniinngg DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) name server's cache database, causing the name server to return an incorrect IP address, diverting traffic to another computer (often the attacker's). 10/07/14 UNIVERSITY OF WISCONSIN 52
- 53. DDiirreeccttoorryy SSeerrvviicceess Directory services are software programs that link directly into core databases to manage the identities and security of users on a network. They are crucial to many medium and large organisations. 10/07/14 UNIVERSITY OF WISCONSIN 53
- 54. NNAATT NNeettwwoorrkk AAddddrreessss TTrraannssllaattiioonn NAT (Network Address Translation or Network Address Translator) is the translation of an Internet Protocol address (IP address) used within one network to a different IP address known within another network. 10/07/14 UNIVERSITY OF WISCONSIN 54
- 55. TThhee CCoorrppoorraattee IInnttrraanneett a local or restricted communications network, especially a private network created using World Wide Web software. 10/07/14 UNIVERSITY OF WISCONSIN 55
- 56. TThhee CCoorrppoorraattee EExxttrraanneett An intranet that can be partially accessed by authorized outside users, enabling businesses to exchange information over the Internet securely. 10/07/14 UNIVERSITY OF WISCONSIN 56
- 57. TThhee LLAANN A local area network (LAN) is a computer network that interconnects computers within a limited area such as a home, school, computer laboratory, or office building, using network media. 10/07/14 UNIVERSITY OF WISCONSIN 57
- 58. TThhee MMAANN A Metropolitan Area Network (MAN) is a large computer network that spans a metropolitan area or campus. Its geographic scope falls between a WAN and LAN. MANs provide Internet connectivity for LANs in a metropolitan region, and connect them to wider area networks like the Internet. 10/07/14 UNIVERSITY OF WISCONSIN 58
- 59. TThhee WWAANN A wide area network (WAN) is a computer network that spans a relatively large geographical area and consists of two or more interconnected local area networks (LANs). A LAN is a network that connects computers and other devices in a relatively small area, typically a single building or a group of adjacent buildings. 10/07/14 UNIVERSITY OF WISCONSIN 59
- 60. QQuuaalliittyy ooff SSeerrvviiccee QQOOSS Quality of service (QoS) is the overall performance of a telephony or computer network, particularly the performance seen by the users of the network. Three levels of QOS are: Best Effort – We try Differentiated Service – We elevate above best effort Guaranteed Service – Has priority over all 10/07/14 UNIVERSITY OF WISCONSIN 60
- 61. RReemmoottee AAcccceessss aanndd WWaarrddiiaalliinngg Remote access is the ability to get access to a computer or a network from a remote distance. In corporations, people at branch offices, telecommuters, and people who are travelling may need access to the corporation's network. 10/07/14 UNIVERSITY OF WISCONSIN 61
- 62. WWaarr DDiiaalliinngg War dialing or wardialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems and fax machines. Hackers use the resulting lists for various purposes: hobbyists for exploration, and crackers - malicious hackers who specialize in computer security - for guessing user accounts (by capturing voicemail greetings), or locating modems that might provide an entry-point into computer or other electronic systems. It may also be used by security personnel, for example, to detect unauthorized devices, such as modems or faxes, on a company's telephone network. 10/07/14 UNIVERSITY OF WISCONSIN 62
- 63. DDSSLL aanndd CCaabbllee MMooddeemmss AA NNeeww VVuullnneerraabbiilliittyy In the old days, people would dialup, connect and then disconnect to the Internet via modem Exposure time was limited DSL and cable modems are always on, so exposure time is no longer limited, creating an opportunity for hackers 10/07/14 UNIVERSITY OF WISCONSIN 63
- 64. VViirrttuuaall PPrriivvaattee NNeettwwoorrkk VVPPNN A virtual private network (VPN) is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization's network. 10/07/14 UNIVERSITY OF WISCONSIN 64
- 65. 880022..1111 WWiirreelleessss NNeettwwoorrkkss A family of IEEE standards that extend the common wired Ethernet local network standard into the wireless domain. The 802.11 standards are widely known as "Wi-Fi" because the Wi-Fi Alliance provides certification for 802.11 products. There have been four major 802.11 standards designated with letter suffixes (a, b, g and n); the latest and fastest being 802.11n (the slowest is 802.11b, and the two medium speed are 802.11a and 802.11g). For more about Wi-Fi networks, see wireless LAN and Wi-Fi. Following are the 802.11 specifications, from slowest to fastest. 10/07/14 UNIVERSITY OF WISCONSIN 65
- 66. BBlluueettooootthh WWiirreelleessss Bluetooth wireless technology is a technology that allows computers, phones, headsets, PDA's and other devices to wirelessly communicate over short distances (typically about 33 feet). Encrypted Low power Simple protocol (relative to wifi) 10/07/14 UNIVERSITY OF WISCONSIN 66
- 67. MMoobbiillee PPhhoonnee SSeeccuurriittyy Usually not encrypted Mobile base station impersonation Mobile phone cloning Encrypted over wireless portion, but usually not over the wired backhaul connection Access to Internet, bypassing corporate firewalls Malware threats worse than on a regular computer Ability to access camera is a threat 10/07/14 UNIVERSITY OF WISCONSIN 67
- 68. WWiirreelleessss BBeesstt PPrraaccttiicceess At least enable WEP, if not stronger encryption Change default SSID (name of network) Disable broadcast SSID (name of network) Place the Access Point at the center of the building to avoid external access Configure the Access Point to only allow known MAC (hardware) addresses into the network 10/07/14 UNIVERSITY OF WISCONSIN 68
- 69. AA NNoottee AAbboouutt RRoooottkkiittss A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer.[1] The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool). The term "rootkit" has negative connotations through its association with malware.[1] 10/07/14 UNIVERSITY OF WISCONSIN 69
- 70. DDaannggeerrss ooff IInnssttaanntt MMeessssaaggiinngg IIMM Communication via IM is usually not encrypted IM often allows the transfer of files, which could enable someone to send sensitive data off-site without being noticed by corporate detection systems, which may not be setup to monitor unauthorized and unknown use of IM for personal purposes (Facebook IM) 10/07/14 UNIVERSITY OF WISCONSIN 70