CS20Network Security and Protecting Systems

Every device connected to a network is a possible way in for an attacker. Network security protects the network, the devices on it and the data it carries.

• Protect data: organisations hold personal and financial data about customers, patients and staff. If it is stolen or changed, people can be harmed, e.g. by fraud.
• Stop unauthorised access: only the right people and devices should get onto the network and see each resource.
• Stop malware spreading: on a network, one infected device can infect many others.
• Keep the network working: an attack that deletes data or takes systems offline stops people working, which costs money.
• Legal duty and reputation: organisations must protect personal data by law. A breach can lead to fines, legal action and customers going elsewhere.

Network security

Protecting a network, its devices and its data from attack, damage and unauthorised access.

Authentication is the process of confirming someone is who they say they are. The most common way is a username and password.

• On a network, authentication stops unauthorised users logging on and lets the network give each user their own access rights.
• A strong password is long (e.g. 12 characters or more) and mixes upper and lower case letters, digits and symbols, or is made of several random words. It isn’t a dictionary word, a name or a date.
• A password system (policy) sets the rules, for example:
• • a minimum length and mix of characters, checked when the password is set;
• • the account locks after a few wrong attempts (e.g. 5), so a person or program can’t keep guessing;
• • passwords must be changed if they may have been seen, and can’t be reused;
• • passwords must never be shared or written down;
• • default passwords on new devices must be changed straight away.
• Two-factor authentication (2FA) adds a second check from a different kind of thing, e.g. a password and a code sent to the user’s phone, or a password and a fingerprint. A stolen password alone is then not enough.

Authentication

The process of confirming someone is who they say they are, e.g. by username and password.

Password system

Rules for creating, using and protecting passwords, such as minimum length, lockouts and no sharing.

Two-factor authentication (2FA)

Logging in needs two different kinds of evidence, e.g. a password and a code sent to a phone.

Biometric measures use unique physical characteristics that can be used to identify individuals, for example fingerprints, voice and facial scans.

• On mobile devices: fingerprint sensors and face recognition unlock phones and tablets and approve payments and app logins.
• The device stores a template of the user’s fingerprint or face. Each scan is compared with the template.

Biometric measures

Unique physical characteristics that can be used to identify individuals, e.g. fingerprints, voice, facial scans.

Encryption is using an algorithm to convert a message into a form that is not understandable without the key to decrypt it.

• Readable data (plaintext) is turned into scrambled data (ciphertext) using an algorithm and a key.
• Only someone with the right key can decrypt the ciphertext back into plaintext.
• When it’s used: data sent over a network, especially a wireless one that anyone in range can pick up; web pages sent by HTTPS; messaging apps; data stored on laptops and phones that could be lost or stolen.
• Encryption protects data even if every other defence fails: if an attacker gets the data, they still can’t read it.

Encrypted data can be intercepted, but not understood

Encryption

Using an algorithm to convert a message into a form that is not understandable without the key to decrypt it.

Plaintext

Data in its readable form, before encryption.

Ciphertext

Encrypted data that can’t be understood without the key.

Key

The value used with the algorithm to encrypt or decrypt data.

A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

• It usually sits between a private network (e.g. an office LAN) and the Internet. Many computers also run firewall software.
• Its rules can look at: IP addresses (where traffic comes from or goes to), ports (which service the traffic is for) and MAC addresses.
• Example rules: block all incoming connections that the network didn’t ask for; block traffic from addresses known to send attacks; block outgoing traffic to known malicious sites, so malware already inside can’t send data out; only allow the services the business needs.
• When it’s used: on any network connected to the Internet, from a home router to a large company.
• Limits: a firewall can’t stop a user being tricked by social engineering, or malware brought in on a USB stick; it can’t inspect the contents of encrypted traffic; and it is only as good as its rules, which must be set up and kept up to date.

Traffic is allowed or blocked by the firewall’s rules

Firewall

A network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

MAC address filtering allows devices to access, or be blocked from accessing, a network based on their physical address embedded within the device’s network adapter.

• A MAC address (Media Access Control address) is a unique identifier assigned to a network device. It is written as six pairs of hexadecimal digits, e.g. 3C:5A:B4:0E:91:7F.
• Allow list: only devices whose MAC addresses are on the list can join. Block list: listed devices are refused.
• When it’s suitable: a network with a small, known set of devices, e.g. a home, or an office whose computers rarely change.
• When it isn’t: a network that many unknown or changing devices must join, e.g. visitors in a café, because every new device would have to be added to the list first.
• Limits: a MAC address can be copied (spoofed) by an attacker who sees one on the network; some phones use a random ‘private’ MAC address for each network, which can break an allow list; and it controls devices, not people: anyone using an allowed device gets on.

MAC address

A unique identifier assigned to a network device, embedded in its network adapter.

MAC address filtering

Allowing devices to access, or blocking them from accessing, a network based on the physical address embedded within the device’s network adapter.

• CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is a challenge that is easy for humans to solve but hard for computers, e.g. picking the pictures with traffic lights, or typing distorted letters.
• What CAPTCHA stops: bots (programs) that create thousands of fake accounts, post spam through forms, buy up tickets, or try thousands of passwords on a login page.
• Email confirmation: when someone registers for an account, the site sends an email with a link or code. The account only becomes active when it is used.
• What email confirmation does: proves the person registering really owns that email address, so nobody can sign up using someone else’s email, and fake accounts with made-up addresses are stopped. It also gives the site a checked address to send password resets to.

CAPTCHA

Completely automated public Turing test to tell computers and humans apart: a challenge that is easy for humans to solve but hard for computers.

Email confirmation

A link or code sent to the email address given at registration, to confirm the user’s identity and that they own the address.

Bot

A program that carries out tasks automatically, such as filling in web forms.

Software makers release updates (patches) that fix security weaknesses as they are found. Automatic updates download and install these without the user having to do anything.

• Why automatic beats manual:
• • a user may forget or keep putting off a manual update, leaving the weakness open;
• • automatic updates are installed as soon as they are released, before attackers have long to use the weakness;
• • they come directly from the software maker, a trusted source; an update found manually could come from a fake or infected site;
• • an IT team can make sure every computer on a network is updated, not just the ones whose users remember.
• Drawbacks: an update may restart a computer at a bad time, or occasionally cause a problem with other software. Outdated software that the maker no longer supports gets no updates, so it should be replaced.

Automatic software updates

Updates, including security patches, downloaded and installed without the user having to start them.

No single method stops every attack. Using several together (layers) gives a greater level of security: if one is beaten, the next can still stop the attack.

Four layers of network security