Asistente de Estudio para Examen de Seguridad de Redes

I cannot access the textbook directly, but I can help you study using widely available summaries and standard network security principles aligned with Stallings & Brown’s "Computer Security: Principles and Practice" (5th Ed.), Chapters 1–6. Below is a structured review, with special detail on the client-server connection process as requested. --- **1. Security Fundamentals (Ch. 1)** - **CIA triad**: Confidentiality (secrecy), Integrity (accuracy), Availability (accessibility). - **Threats**: Interception, interruption, modification, fabrication. - **Attacks**: Passive (eavesdropping, traffic analysis) vs. active (masquerade, replay, denial of service). - **Security services**: Authentication, access control, data confidentiality, data integrity, non-repudiation, availability. - **Security mechanisms**: Encryption, digital signatures, access control lists, audit trails. - **Trust model**: Assets, vulnerabilities, threats, risk, countermeasures. **2. Cryptographic Tools (Ch. 2)** - **Symmetric encryption**: AES (block cipher, 128/192/256-bit keys), modes (ECB, CBC, CFB, OFB, CTR). - **Asymmetric encryption**: RSA (based on factoring), Diffie-Hellman (key exchange), ECC (elliptic curve). - **Hash functions**: SHA-256, SHA-3; properties (preimage resistance, second preimage resistance, collision resistance). - **Message authentication**: HMAC (keyed hash), digital signatures (sign with private key, verify with public key). - **Key distribution**: Public key infrastructure (PKI), certificates (X.509), certificate authorities (CA). - **Random numbers**: Needed for keys, nonces, salts; use CSPRNG. **3. Internet Security Protocols & Standards (Ch. 3)** - **IPsec**: Provides confidentiality, integrity, and authentication at IP layer. Two protocols: AH (authentication header, no encryption) and ESP (encapsulating security payload, encryption + auth). Modes: transport (host-to-host) and tunnel (gateway-to-gateway). - **SSL/TLS**: Operates between transport and application layers. Handshake (negotiate cipher suite, exchange keys, authenticate server), record protocol (fragmentation, compression, MAC, encryption). TLS 1.3 removes weak options. - **HTTPS**: HTTP over TLS, port 443. - **Email security**: PGP (Pretty Good Privacy) - uses hybrid encryption (session key + RSA), S/MIME (uses X.509 certificates). - **Kerberos**: Authentication protocol using tickets and a trusted third party (KDC). Uses symmetric keys, timestamps to prevent replay. **4. User Authentication (Ch. 4)** - **Four factors**: Something you know (password), something you have (token, smart card), something you are (biometric), somewhere you are (location). - **Password attacks**: Dictionary, brute force, rainbow tables, shoulder surfing, phishing. - **Password storage**: Salted hashes (e.g., bcrypt, PBKDF2) to resist precomputation. - **Biometrics**: Fingerprint, iris, voice; false accept rate (FAR) vs. false reject rate (FRR). - **Mutual authentication**: Both parties verify each other (e.g., challenge-response with nonce). - **Single sign-on (SSO)**: Kerberos, SAML, OAuth. **5. Access Control (Ch. 5)** - **Subjects, objects, operations**: Subject (user/process) requests access to object (file/resource) with operation (read/write/execute). - **Access control models**: - DAC (Discretionary): Owner sets permissions (e.g., Unix rwx). - MAC (Mandatory): System enforces labels (e.g., Bell-LaPadula for confidentiality, Biba for integrity). - RBAC (Role-based): Permissions assigned to roles, users get roles. - **Access control lists (ACLs)**: List of (subject, permission) per object. - **Capability lists**: List of (object, permission) per subject. - **Authorization vs. authentication**: Authentication verifies identity; authorization decides what that identity can do. **6. Database Security (Ch. 6)** - **Database integrity**: Entity integrity (primary keys), referential integrity (foreign keys), semantic integrity (business rules). - **SQL injection**: Attack via malicious input in queries; defense: parameterized queries, stored procedures, input validation. - **Database encryption**: Transparent data encryption (TDE), column-level encryption. - **Inference attacks**: Combining multiple queries to deduce sensitive data; defense: query restriction, cell suppression. - **Auditing**: Log all access attempts, track changes. **7. Malicious Software (Ch. 6, part 2)** - **Types**: Virus (attaches to files), worm (self-replicates over network), Trojan horse (disguised as useful), ransomware (encrypts data for ransom), spyware (monitors activity), rootkit (hides presence). - **Propagation vectors**: Email attachments, USB drives, drive-by downloads, social engineering. - **Payloads**: Data destruction, keylogging, backdoor, botnet recruitment. - **Defense**: Antivirus (signature-based, heuristic, behavioral), firewalls, patch management, user education. --- **Detailed: How a Client Connects to a Server (likely easy question)** This process involves several layers, from physical to application. Here is a step-by-step breakdown, assuming a typical TCP/IP connection over the internet (e.g., a web browser connecting to a web server): **Step 1: DNS Resolution** - Client enters a URL (e.g., `https://www.example.com`). - The client’s OS sends a DNS query to a configured DNS server (usually via UDP port 53). - DNS server returns the IP address (e.g., `93.184.216.34`). If not cached, it queries recursively through root, TLD, and authoritative servers. **Step 2: TCP Three-Way Handshake** - Client initiates a TCP connection to the server’s IP on port 80 (HTTP) or 443 (HTTPS). - **SYN**: Client sends a TCP segment with SYN flag set, random sequence number (e.g., `seq=1000`). - **SYN-ACK**: Server responds with SYN+ACK, its own sequence number (e.g., `seq=5000`), and acknowledges client’s sequence (`ack=1001`). - **ACK**: Client sends ACK with `ack=5001`. Connection is established. - This ensures both sides are ready and synchronizes sequence numbers for reliable data transfer. **Step 3: TLS Handshake (if HTTPS)** - Client sends a `ClientHello` with supported cipher suites, TLS version, and a random nonce. - Server responds with `ServerHello` (chosen cipher suite, server nonce), its certificate (containing public key), and optionally requests client certificate. - Client verifies the certificate against a trusted CA (checks validity, signature, hostname). - Client generates a pre-master secret, encrypts it with the server’s public key, sends it. - Both sides derive session keys (symmetric) from the pre-master secret and nonces. - Client sends `Finished` (encrypted), server sends `Finished`. Handshake complete; all subsequent data is encrypted. **Step 4: HTTP Request** - Client sends an HTTP request (e.g., `GET /index.html HTTP/1.1` with headers like `Host: www.example.com`, `User-Agent`, `Accept`). - The request is broken into TCP segments, each with sequence numbers, and sent over the established connection. **Step 5: Server Processing** - Server’s OS reassembles TCP segments into the full HTTP request. - Web server (e.g., Apache, Nginx) parses the request, checks access control (e.g., authentication, authorization), retrieves the resource (file, database query), and prepares an HTTP response (e.g., `200 OK` with HTML content, or `404 Not Found`). **Step 6: HTTP Response** - Server sends the response back over the same TCP connection (or a new one if keep-alive is off). - The response includes status line, headers (Content-Type, Content-Length), and body. **Step 7: Client Receives and Displays** - Client’s OS reassembles TCP segments, passes data to the TLS layer (if HTTPS) for decryption, then to the browser. - Browser parses HTML, fetches additional resources (CSS, JS, images) via new requests (often parallel connections or HTTP/2 multiplexing). - Renders the page. **Step 8: Connection Termination** - After all data is exchanged, either side can close the connection using a TCP FIN handshake (FIN, ACK, FIN, ACK). - If using HTTP/1.1 with keep-alive, the connection stays open for a timeout for subsequent requests. **Security considerations during this process**: - **DNS spoofing**: Attacker could poison DNS cache; use DNSSEC. - **TCP hijacking**: Sequence number prediction; use encryption (TLS) to prevent. - **Man-in-the-middle**: TLS certificate validation prevents impersonation. - **Session hijacking**: Use secure cookies (Secure flag, HttpOnly), session tokens, and HTTPS. - **Firewalls/IDS**: May inspect or block traffic at network boundaries. --- **Study tips**: - Practice drawing the TCP handshake and TLS handshake diagrams. - Memorize the CIA triad and the difference between passive/active attacks. - For access control, compare DAC vs. MAC vs. RBAC with examples. - For malicious software, know the lifecycle (propagation, activation, payload). - For the client-server question, be ready to explain each step verbally, including ports (80, 443, 53) and why TLS is used. If you need more detail on any specific topic, let me know. Good luck on your exam!

Asistente de Estudio para Examen de Seguridad de Redes

Contenido del PromptGuardar

Uso

Referencias

Discusión