Network Security

Learning Outcomes:

Describe the potential risks caused by the common network security threats.

The threats include virus, worm and Trojan programs, spyware, unauthorised access, interception, and Denial of Service (DoS) attack, etc.

Propose effective measures to improve network security for both wired and wireless networks.

The measures include anti-virus software, authentication, access and user right control, packet filtering, firewall, public and private key encryption, Wired Equivalent Privacy (WEP), and IPsec used in Virtual Private Network (VPN), etc.
Encryption mechanisms to guarantee a message is both authentic and private should be known. Detailed implementation algorithms of public and private key encryption are not required. Technical details on how a VPN is constructed are not required.

Network security threats

Virus: malicious program that injects malicious code into existing applications in order to spread.

Worm: malicious program that can self-replicate and infect other computers. This affects system performance and consumes network bandwidth.

Trojan programs: malware that disguises as legitimate software.

Spyware: malware that tries to keep itself hidden and steals sensitive information.

Adware: malware that hijacks your system and displays advertisements in your computer.

Denial of Service (DoS) attack: prevent users from accessing resources by overloading the network/system with fake communication requests. E.g. ping flood – overwhelm the victim with huge number of ping requests.

Relevant past paper:

DSE ICT Elect B(SP-2017): SP 4g. 2015 2cii. 2016 4d.

CE CIT Elec C(2005-2011): 2006 4g. 2008 1h.

Network security measures

Antivirus

Mechanism e.g. signature analysis: identify the specific code/pattern that the virus carries.
Therefore, it is important to keep it up-to-date and active.

Authentication

Password recommendations:

Minimum 8-character length
Multi-factor authentication
Avoid common passwords or using personal information as password

(regularly changing password and mixing uppercase/lowercase/non-alphanumeric characters are not recommended now)

Access and user right control

Software control: block different ports e.g. USB port. Block certain IP addresses. User rights of operating system.
Hardware control: MAC filtering (feasible if MAC addresses of devices known and infrequent update needed)

Firewall

Mechanism: Packet filtering based on access control list. (Control inbound and outbound communications)
Block packets based on criteria such as source IP addresses and port number.
In terms of security, proxy server helps to hide the internal network IP addresses and restrict access to certain websites, while firewall filters unwanted packets.

Public and private key encryption (Asymmetric key encryption)

Sender A	Receiver B	Result
Use B’s public key for encryption	Use own private key for decryption	Only B can read the message
Use own private key for encryption	Use A’s public key for decryption	Message is really from A. (Digital signature)

Encrypt twice with both methods can serve both purposes. But it is also more time consuming.

Wired Equivalent Privacy(WEP)

See wireless network

IPsec used in Virtual Private Network (VPN)

IPsec is used to set up encrypted connections between devices. IPsec is also implemented in IPv6.
Virtual Private Network (VPN) establishes communication channel between you and the VPN server with the data encrypted.

Disadvantages: complicated in configuration and connection speed can be slow.

Protocols with encryption

HyperText Transfer Protocol Secure (HTTPS). Encrypted using TLS.
Secure Sockets Layer (SSL). The newer one is Transport Layer Security (TLS).
Secure Shell (SSH). For communication between computers.

Relevant past paper:

DSE ICT Elect B(SP-2017): SP 3b,ci, 4f. PP 2a(P1), 3ai,b,c, 4c. 2012 1bii. 2013 1bii,ci. 2014 3abii,c, 4aiii,ci. 2015 1bii, 2ci, 3c. 2016 2ci. 2017 1bii,c, 2cii.

CE CIT Elec C(2005-2011): 2005 4efg. 2006 3g, 4f. 2007 4f. 2008 2e, 4de. 2009 1bd. 2010 3e, 4bvi.

AS CA(2000-2013): 2003 10dii. 2004 9ci. 2006 4b, 10ceg. 2007 7, 9e. 2009 1a, 9f. 2010 9fii. 2011 8dg. 2013 10f.

For interest only: AS CA: 2003 10abcdi. 2005 2.

References:

https://securitytrails.com/blog/top-10-common-network-security-threats-explained

https://www.usnews.com/360-reviews/antivirus/how-does-antivirus-software-work

https://docs.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide

https://www.tutorialspoint.com/network_security/network_security_firewalls.htm

https://www.preveil.com/blog/public-and-private-key/

https://www.gov.hk/en/residents/communication/infosec/digitalcert.htm

https://www.cloudflare.com/learning/network-layer/what-is-ipsec/

https://www.usnews.com/360-reviews/vpn/what-is-a-vpn