NETWORK SECURITY
LECTURE 1: INTRODUCTION TO NETWORK SECURITY
NCS2101
Class Management Rules
1. No food (solid or liquid except water) is allowed in the class. Students
who bring water to the class should make sure they leave it on the floor.
2. No use of cell phones or any other gadgets in the classroom. This
includes the use of laptops, except during lab activities.
3. No side discussions or distraction of any kind in the class during lecture
hours. All questions or needed clarifications should be directed to the
instructor.
4. All students are to appear in the approved dress-code always.
5. Class attendance will be conducted within the first 1-5 minutes of class
resumption. Students who come to class between the first 5-10 minutes
will be marked as LATE attendance while those afterwards will be marked
as ABSENT.
6. There is only 24 hours grace period for every missed assessment
submission with cogent reason. After this period, submissions are no
longer accepted
Course Learning Objectives - NCS-2101
CLO1. Classify security principles used to protect
computer networks
CLO2. Identify various security threats and attacks on
computer networks
CLO3. Apply Access Control Lists (ACLs) to improve
network security
CLO4. Evaluate different security solutions for
computer networks
CLO5. Choose best critical network security controls
given certain requirements
CLO6. Devise appropriate defense mechanisms for
typical network attacks
CLO7. Demonstrate the use of cryptographic protocols
Outline
Security Problem
What is “Security”?
Security Objectives
OSI Security Architecture
Security Parameters
Security Services
Security Mechanism
Network Security Model
Security Trinity
Goals of Network Security
Who are potential attackers?
Security Problem
Security Problem
The evolution of technology has been
focused on ease of use more than security.
Increased network environments and
network-based applications have
introduced new ways of systems security
explosion.
With the development of information
systems, the methods of attacking such
systems have also evolved rapidly
What is “Security”?
Security Objectives
Security Objectives
OSI Network Layers
10 of 23
OSI Security Architecture
Security Parameters
Security Attacks
Passive Attacks
Active Attacks
Examples of Active Attacks
Security Services
Security Services
Security Mechanism
Security services vs Security mechanisms
Network Security Model
The Security Trinity
The three legs of the "security
trinity," prevention, detection,
and response, comprise the
basis for network security.
The security trinity should be
the foundation for all security
policies and measures that an
organization develops and
deploys.
The Security Trinity: Overview
Prevention:
To provide some level of security, it is necessary to
implement measures to prevent the exploitation of
vulnerabilities. It is the foundation of the security trinity.
Detection
Once preventative measures are implemented,
procedures need to be put in place to detect potential
problems or security breaches; in the event preventative
measures fail. It is very important that problems be
detected immediately. The sooner a problem is detected
the easier it is to correct and cleanup.
Response
Organizations need to develop a plan that identifies the
appropriate response to a security breach.
The Security Trinity: Tools
1. Prevention:
•Firewalls
•Intrusion Prevention Systems (IPS)
•Access Control
•Patch Management
•Network Segmentation
2. Detection:
•Intrusion Detection Systems (IDS)
•Security Information and Event Management (SIEM)
•Anomaly Detection
•Packet Analysis
•Behavioral Analysis
3. Response:
•Incident Response Plan
•Threat Hunting
•Isolation and Quarantine.
•Forensics
•Communication
Who are the potential attackers?
1. Script Kiddies and Opportunistic Attackers:
•These individuals have limited technical skills and often use pre-existing tools and
scripts to launch attacks.
•Their motivations might be curiosity or a desire to cause chaos, and they tend to target
low-hanging fruit with known vulnerabilities.
2. Hackers and Cybercriminals:
•These individuals or groups have more advanced technical skills and target
organizations or individuals for financial gain.
•Motivations include stealing credit card information, personal data, or using
ransomware to extort money.
3. Insiders:
•Insiders have legitimate access to systems but misuse that access for personal gain or
to harm the organization.
•Motivations could range from financial motives to a desire for revenge or exposure of
sensitive information.
4. Nation-State Actors and APTs (Advanced Persistent Threats):
•State-sponsored attackers have significant resources and advanced capabilities.
•They engage in espionage, cyberwarfare, and strategic attacks to further political,
military, or economic agendas.
5. Hacktivists:
•These attackers are motivated by political or social causes and target organizations to
raise awareness or promote their ideologies.
•Their actions could include website defacements, data leaks, and Distributed Denial of
Service (DDoS) attacks.
Who are the potential attackers?
6. Competitors and Corporate Espionage:
•Rival companies or individuals seek to gain a competitive edge by stealing
proprietary information, trade secrets, or intellectual property.
7. Malware Developers and Distributors:
•These individuals or groups create and distribute malicious software,
including viruses, worms, and Trojans.
•Their motivations can range from financial gain to causing disruption.
8. Phishers and Social Engineers:
•Attackers in this category manipulate human psychology to trick individuals
into revealing sensitive information.
•Their tactics include phishing emails, phone scams, and other forms of social
engineering.
9. Disgruntled Individuals:
•Former employees, users, or partners who hold a grudge against an
organization and seek to harm its reputation or operations.
10. Organized Crime Groups:
•Well-coordinated criminal organizations engage in cybercrime for financial
gain, targeting businesses, individuals, and critical infrastructure.
11. Black Hat vs. White Hat Hackers:
•Black hat hackers engage in malicious activities for personal gain or
disruption.
•White hat hackers, also known as ethical hackers, use their skills to identify
27
Q &A
References
Design Zone for Security: SAFE - Cisco
