CYS406 · Chapter 10 · Annotated SlidesNetwork Security Protocols
Original
Overview

Network Security Protocols

RADIUS and TACACS+ for AAA, Kerberos, email security with PGP and S/MIME, HTTPS, TLS and SSL, and IPsec.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 29 slides
  1. 1 Slide 1
  2. 2 Module Objectives
  3. 3 Module Flow
  4. 4 Network Security Controls: Technical Security Controls
  5. 5 Network Security Protocols
  6. 6 Network Security Protocols
  7. 7 Network Security Protocols
  8. 8 Remote Authentication Dial-in User Service (RADIUS)
  9. 9 Remote Authentication Dial-in User Service (RADIUS) (Cont’d)
  10. 10 Remote Authentication Dial-in User Service (RADIUS) (Cont’d)
  11. 11 Terminal Access Controller Access Control System Plus (TACACS+)
  12. 12 Terminal Access Controller Access Control System Plus (TACACS+)
  13. 13 RADIUS vs TACACS+
  14. 14 Kerberos
  15. 15 Pretty Good Privacy (PGP)
  16. 16 Pretty Good Privacy (PGP)
  17. 17 Secure/Multipurpose Internet Mail Extensions (S/MIME)
  18. 18 Secure/Multipurpose Internet Mail Extensions (S/MIME)
  19. 19 Secure/Multipurpose Internet Mail Extensions (S/MIME) (Cont’d)
  20. 20 Differences between PGP and S/MIME
  21. 21 Secure Hypertext Transfer Protocol (S-HTTP)
  22. 22 Hypertext Transfer Protocol Secure (HTTPS)
  23. 23 Hypertext Transfer Protocol Secure (HTTPS)
  24. 24 Transport Layer Security (TLS)
  25. 25 Secure Sockets Layer (SSL)
  26. 26 Secure Sockets Layer (SSL)
  27. 27 Internet Protocol Security (IPsec)
  28. 28 Internet Protocol Security (IPsec)
  29. 29 Module Summary
Slide 1 / 29

Slide 1

Slide 1: Slide 1
Slide 2 / 29

Module Objectives

Slide 2: Module Objectives
Slide 3 / 29

Module Flow

Slide 3: Module Flow
Slide 4 / 29

Network Security Controls: Technical Security Controls

Slide 4: Network Security Controls: Technical Security Controls
Slide 5 / 29

Network Security Protocols

Slide 5: Network Security Protocols
Slide 6 / 29

Network Security Protocols

Slide 6: Network Security Protocols
Slide 7 / 29

Network Security Protocols

Slide 7: Network Security Protocols
Slide 8 / 29

Remote Authentication Dial-in User Service (RADIUS)

Slide 8: Remote Authentication Dial-in User Service (RADIUS)

Notes

  1. RADIUS: centralized AAA over UDP (1812/1813); encrypts only the password.

Slide 9 / 29

Remote Authentication Dial-in User Service (RADIUS) (Cont’d)

Slide 9: Remote Authentication Dial-in User Service (RADIUS) (Cont’d)
Slide 10 / 29

Remote Authentication Dial-in User Service (RADIUS) (Cont’d)

Slide 10: Remote Authentication Dial-in User Service (RADIUS) (Cont’d)
Slide 11 / 29

Terminal Access Controller Access Control System Plus (TACACS+)

Slide 11: Terminal Access Controller Access Control System Plus (TACACS+)

Notes

  1. TACACS+ (Cisco): TCP 49, encrypts the whole body, separates authentication, authorization and accounting.

Exam angle

PredictionQ1

Compared with RADIUS, TACACS+:

Slide 12 / 29

Terminal Access Controller Access Control System Plus (TACACS+)

Slide 12: Terminal Access Controller Access Control System Plus (TACACS+)
Slide 13 / 29

RADIUS vs TACACS+

Slide 13: RADIUS vs TACACS+
Slide 14 / 29

Kerberos

Slide 14: Kerberos

Notes

  1. Kerberos: ticket-based authentication with a KDC (AS + TGS); uses symmetric keys and timestamps; needs synchronized clocks.

Exam angle

PredictionQ1

Kerberos issues users a:

Slide 15 / 29

Pretty Good Privacy (PGP)

Slide 15: Pretty Good Privacy (PGP)

Notes

  1. PGP: email/file confidentiality, integrity, authentication; web of trust.

Slide 16 / 29

Pretty Good Privacy (PGP)

Slide 16: Pretty Good Privacy (PGP)
Slide 17 / 29

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Slide 17: Secure/Multipurpose Internet Mail Extensions (S/MIME)

Notes

  1. S/MIME: secure email using X.509 certificates (hierarchical CA trust).

  2. Memory trick PGP = web of trust; S/MIME = certificate authorities.

Slide 18 / 29

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Slide 18: Secure/Multipurpose Internet Mail Extensions (S/MIME)
Slide 19 / 29

Secure/Multipurpose Internet Mail Extensions (S/MIME) (Cont’d)

Slide 19: Secure/Multipurpose Internet Mail Extensions (S/MIME) (Cont’d)
Slide 20 / 29

Differences between PGP and S/MIME

Slide 20: Differences between PGP and S/MIME
Slide 21 / 29

Secure Hypertext Transfer Protocol (S-HTTP)

Slide 21: Secure Hypertext Transfer Protocol (S-HTTP)

Notes

  1. HTTPS = HTTP over TLS (port 443).

Slide 22 / 29

Hypertext Transfer Protocol Secure (HTTPS)

Slide 22: Hypertext Transfer Protocol Secure (HTTPS)
Slide 23 / 29

Hypertext Transfer Protocol Secure (HTTPS)

Slide 23: Hypertext Transfer Protocol Secure (HTTPS)
Slide 24 / 29

Transport Layer Security (TLS)

Slide 24: Transport Layer Security (TLS)

Notes

  1. TLS (successor to SSL): handshake negotiates ciphers, authenticates the server with a certificate, and derives session keys.

Exam angle

PredictionQ1

SSL is still considered secure and preferred over TLS.

Slide 25 / 29

Secure Sockets Layer (SSL)

Slide 25: Secure Sockets Layer (SSL)
Slide 26 / 29

Secure Sockets Layer (SSL)

Slide 26: Secure Sockets Layer (SSL)
Slide 27 / 29

Internet Protocol Security (IPsec)

Slide 27: Internet Protocol Security (IPsec)

Notes

  1. IPsec: network-layer security. AH = integrity/authentication (no encryption); ESP = encryption (+ integrity). Transport mode protects the payload; tunnel mode protects the whole packet.

Exam angle

PredictionQ1

Which IPsec protocol provides encryption?

PredictionQ2

IPsec mode that encapsulates the entire original IP packet (used for site-to-site VPNs):

Slide 28 / 29

Internet Protocol Security (IPsec)

Slide 28: Internet Protocol Security (IPsec)
Slide 29 / 29

Module Summary

Slide 29: Module Summary