1.0 Network Security


1.4 Given a scenario, implement common protocols and services.

  • Protocols

    • IPSec

      IPsec is a protocol suite that provides an authentication and encapsulation standard used to establish and secure communications between servers and clients to prevent attacks from external sources. While most security systems function within the application layer of the OSI model, IPsec is implemented at the network layer.



    • SNMP

      Simple Network Management Protocol (SNMP) is an "Internet-standard protocol for managing devices on IP networks. Devices that typically support SNMP include routers, switches, servers, workstations, printers, modem racks, and more." It is used mostly in network management systems to monitor network-attached devices for conditions that warrant administrative attention.



    • SSH

      Secure Shell (SSH) is a cryptographic remote login protocol for secure data communication over an unsecured network. Designed as a replacement for telnet and rlogin, which send information in plaintext, SSH client and server programs provide strong host-to-host and user authentication as well as a number of securely encrypted methods of communication to provide confidentiality and integrity of data. SSH supports data stream compression between the client and the server.

      There are two major versions of the SSH protocol in widespread use, SSH v1 and SSH v2. SSH v2 is more secure, and includes SFTP, which is similar to FTP, but is SSH v2 encrypted.

      Secure Shell uses port 22.



    • DNS

      The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. Internet and TCP utilities such as telnet, FTP, and SMTP use DNS to translate computer host and domain names to their corresponding IP addresses. DNS allows you to type recognizable names into your Web browser and your computer will automatically find that address on the Internet. Address information is stored in several locations in a hierarchical structure.



    • TLS

      Transport Layer Security (TLS) is a cryptographic protocol that provides communication security over the Internet. TLS encrypts the segments of network connections above the Transport Layer, using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity.



    • SSL

      The Secure Sockets Layer (SSL) protocol is a security protocol that provides communications privacy and reliability between two communicating applications over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. SSL is a widely implemented protocol that provided the basis for Transport Layer Security (TLS).



    • TCP/IP

      The TCP/IP suite is a collection of internet protocols developed by the Department of Defense. Designed to permit communication among a variety of independent, multivendor systems, support is provided for a wide variety of protocols and services, including TCP, IP, UDP, ARP, and others, on many different types of media. TCP/IP is routable across more than one local area network (LAN). Named for it's two primary protocols, Transmission Control Protocol (TCP) and Internet Protocol (IP), TCP/IP provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination.



    • FTPS

      FTPS is an extension to the commonly used File Transfer Protocol (FTP) that adds support for the Transport Layer Security (TLS) and the Secure Sockets Layer (SSL) cryptographic protocols.



    • HTTPS

      Hypertext Transfer Protocol Secure (HTTPS) is a combination of Hypertext Transfer Protocol (HTTP) with SSL/TLS protocol. It provides encrypted communication and secure identification of a network web server. HTTPS connections are often used for payment transactions on the World Wide Web and for sensitive transactions in corporate information systems. HTTPS uses port 443 by default.

      HTTPS is a lower level Application Layer protocol that typically uses TCP port 443 by default.



    • SCP

      Secure copy or SCP is a means of securely transferring computer files between a local host and a remote host or between two remote hosts. It is based on the Secure Shell (SSH) protocol.



    • ICMP

      The Internet Control Message Protocol (ICMP) is one of the core protocols of the Internet Protocol Suite. It is chiefly used by the operating systems of networked computers to send error messages indicating, for example, that a requested service is not available or that a host or router could not be reached. ICMP can also be used to relay query messages.



    • IPv4

      IPv4 has been superseded by the more recent IPv6 specification.



    • IPv6

      IP version 6 (IPv6) is a new version of the Internet Protocol, designed as the successor to IP version 4 (IPv4). The changes from IPv4 to IPv6 include an increase to the IP address size from 32 bits to 128 bits providing a greater number of available addresses and provision for additional support for authentication and data integrity.



    • iSCSI

      iSCSI is a transport protocol for Internet Small Computer Systems Interface (iSCSI) used for transporting SCSI packets over TCP/IP.



    • Fibre Channel

      Fibre Channel (FC) is a high speed serial interface technology that supports several higher layer protocols including Small Computer System Interface (SCSI) and Internet Protocol(IP).



    • FCoE

      Data center networks are rapidly evolving towards a consolidated approach, where Ethernet is used as the common infrastructure for all types of traffic. Storage traffic, which was traditionally dominated by the Fibre Channel (FC) protocol suite, is evolving towards Fibre Channel over Ethernet (FCoE), where native FC packets are encapsulated with an FCoE encapsulation over an Ethernet header.



    • FTP

      File Transfer Protocol (FTP) is a standard network protocol used to transfer files from one host to another host over a TCP-based network, such as the Internet. FTP is built on a client-server architecture and uses separate control and data connections between the client and server. Authentication is accomplished through the use of a clear-text sign-in protocol and is not considered to be secure.

      File Transfer Protocol first establishes, then maintains a control connection throughout the session over TCP port 21. Then a second connection is opened over TCP port 20 for data transfer.



    • SFTP

      The SSH File Transfer Protocol provides secure file transfer functionality over any reliable, bidirectional octect stream. It is the standard file transfer protocol for use with the SSH2 protocol.



    • TFTP

      Trivial File Transfer Protocol (TFTP) is a simple insecure protocol used to transfer files. It is typically implemented on top of the User Datagram Protocol (UDP) using port number 69. Packets are limited to a 512 byte limit and can be easily lost. When a packet smaller than 512 bytes is received, the server assumes the end of the file has been reached and closes the connection. Transmission is not guaranteed to be complete and has no provision for user authentication. TFTP is designed to be small and easy to implement, therefore, lacks most of the features of FTP. TFTP only reads and writes files (or mail) to or from a remote server, it cannot list directories. TFTP can be used for remote booting of devices without hard drives. Used in conjunction with a bootp server, the device receives its addressing information and the address of the TFTP server from which it should boot.



    • TELNET

      Short for Telecommunications network, TELNET is a text based interface protocol that provides an insecure remote access to other computers. Telnet uses a command line interface and can be accessed in Windows from the Start menu by clicking <Start>, <Run>, then by typing: telnet (somesite) 23. Port number 23 is the default port used by telnet, but is usually optional and often not required.

      TELNET typically uses TCP port 23.



    • HTTP

      Hypertext Transfer Protocol (HTTP) is an application-level protocol used to request and deliver web pages between a server and browser. HTTP is the foundation of data communication for the World Wide Web.

      HTTP is typically implemented using TCP port 80.



    • NetBIOS

      The Network Input Output System (NetBIOS) protocol was originally developed for IBM and Microsoft to support broadband network communication in the small to medium sized local area network environment. It is a Session layer protocol in the OSI model that establishes and manages communication between computers. Data transport services for NetBIOS are provided by NetBEUI.



  • Ports

    The Internet Assigned Numbers Authority currently manages the set of globally reserved port numbers. Port numbers are the original and most widely used means for application and service identification on the Internet. Ports are 16-bit numbers, and the combination of source and destination port numbers together with the IP addresses of the communicating end systems uniquely identifies a session of a given transport protocol. Port numbers are also known by their associated service names.

    Port numbers range from 0 to 65535, and are divided into three groups. Standard or well-known ports make up the first group and use port addresses 0 to 1023. The second group is called registered ports and use address numbers from 1024 to 49151. The final group is called dynamic ports with addresses from 49152 to 65535. Both TCP and UDP protocols use identifiers starting at 1. The protocol used is declared in the incoming datagram.

    RFC 6335 - Service Name and Port Number Procedures

    • 21 - File Transfer Protocol (FTP)

    • 22 - Secure Shell (SSH)

    • 25 - Simple Mail Transfer Protocol (SMTP)

    • 53 - Domain Name System (DNS)

    • 80 - Hypertext Transfer Protocol (HTTP)

    • 110 - Post Office Protocol - Version 3 (POP3)

    • 139 - NETBIOS Session Service

    • 143 - Internet Message Access Protocol (IMAP)

    • 443 - Hypertext Transfer Protocol Secure (HTTPS)

    • 3389 - Microsoft Terminal Server (RDP)


  • OSI relevance





Additional Resources

Recommended

 





Associates