Network Security and Traffic Analysis

This assignment delves into the crucial aspects of network security, focusing on Deep Packet Inspection (DPI) and packet stream analysis. It explains how DPI empowers network managers to gain a comprehensive view of network traffic, identify performance bottlenecks, and detect potential security threats. The importance of packet stream analysis in understanding communication patterns, troubleshooting network issues, and enhancing intrusion detection is also highlighted.

Running head: INFORMATION SECURITY TECHNOLOGIES 1
Information Security Technologies
Name
Date

Running head: INFORMATION SECURITY TECHNOLOGIES 2
Table of Contents
..............................................................................................................................................................1
Topic 3: Encryption.............................................................................................................................3
Topic 4: Secure Networks....................................................................................................................4
Topic 5: Access Control.......................................................................................................................5
Topic 6: Firewalls................................................................................................................................7
References............................................................................................................................................9

Running head: INFORMATION SECURITY TECHNOLOGIES 3
Topic 3: Encryption
Symmetric key encryption
This is a cryptography approach in which the message sender and the receiver share a
common single key used for encrypting and decrypting a message. It uses algorithms where similar
cryptographic keys are used for both plain text message encryption and cipher-text message
decryption. As such, the key is a secret that is shared between the sender and the receiver.
Symmetric encryption is used to ensure confidentiality; it helps keep messages secret and unable to
be intercepted and decrypted before they reach their destination. The process starts with a sender
creating a cipher text through encryption of plain text message using a symmetric encrypting
algorithm as well as a shared key. The created cypher text is then sent by the sender as a message to
the recipient and the receiver then decrypts the sent encrypted message into plain text using the
shared key.
There are two parties involved, and only these two parties have the key for the encrypted
data and information. The space of a key doubles every time a bit is added to it, meaning that longer
keys are much better than shorter keys in ensuring security and confidentiality. Since, for example,
people use patterns they can remember to generate passwords, attackers can build dictionaries of
passwords that are regularly used for launching attacks (Sikorski, Honig & Bejtlich, 2012). The
symmetric key that is encrypted can be changed at every instance, creating a session, but changing
the keys at every session means an attacker cannot decrypt each and every new session key, thereby
enhancing security. There are various symmetric encryption algorithms in use and include Rijndael
and Triple DES; they are designed to perform efficiently on common hardware architectures.
Symmetric is very simple in nature due to the sharing of the secret key between the sender and
recipient.
Public key encryption
This is the opposite of symmetrical key encryption is is usually termed as asymmetric key
encryption where both private and public keys are utilized in data/ message encryption and
decryption. It entails using large numbers that are paired together, although the numbers are
dissimilar. In the pair, one key is shared with anyone and makes up the public key. However, the
other key remains secret and is thus the private key. In public encryption, the strength of the public
key encryption system is based on the degree of computational difficulty for a key that is propery
generated properly to be established from the corresponding public key. Security then becomes
dependent only on ensuring the private key remains private; the public key can be published
without any compromises to security. Either the private or public key can be used for message

Running head: INFORMATION SECURITY TECHNOLOGIES 4
encryption; the opposite key is then used fr data/ message decryption (Cobb, 2016). The public key
encryption is employed both for authentication and confidentiality (Buchmann, Karatsiolis &
Wiesmaier, 2016).
Hashing
Hashing is the act of transforming character strings into a a shorter value or key with a fixed
length to represent the original longer string. It incorporates a mathematical algorithm that maps
arbitrary sized data into bit strings with fixed size to create a one way hash function that cannot be
inverted. Hashing is used for authentication as an HMAC (keyed hash message authentication).
The cryptographic hash function is an algorithm that is run on a specific data such as a password or
file; this produces a value that is called checksum. The hashing function is employed in verifying
how authentic a piece of information of data is. Two pieces of data or files can be guaranteed to be
identical if the checksums that are generated for every file based on the same cryptographic hashing
function remain similar. Hashing functions of cryptography are designed so as to prevent reversal of
checksums created back into their original texts. However, despite being designed so as not to be
reversed, there are loopholes that can be exploited ton reverse hashes; a rainbow table can be
utilized to figure out the plain text of a given checksum. Technically, though, this is not reversing
cryptographic hashes but are helpful for passwords that are simple.
Topic 4: Secure Networks
Implementing strong intrusion detection systems
The intrusion detection systems will detect any anomalies in traffic entering the company’s network
, especially when valid protocols are used by malicious people to as attack vehicles; these would be
different to detect by other methods. The detection systems ill act as the first line of defense; it is
important that an attack is detected and ascertained, before other measures such as contacting the
ISP can be set in motion
Implementing firewall and router configuration against DoS attacks
This entails configuring network routers in such a way that they stop simple pinging attacks
by filtering protocols that are non essential and stopping invalid IP (Internet protocol) addresses.
But routers can be ineffective against sophisticated DoS attacks, hence a firewall should also be
implemented to work with the routers. The firewall should be updated and patched regularly and set
up to shut down specific data flows in a network associated with DoS attacks; hence the need for
intrusion detection systems. The router must be set up in a way that it blocks all inbound traffic that
have a source address from inside the company’s internal networks. This is done because having
inbound traffic having source addresses from the company’s internal network is a sign of spoofing

Running head: INFORMATION SECURITY TECHNOLOGIES 5
and spoofing is among the most challenging forms of DoS attacks to stop..or even detect. The
routers should also be set to stop all outbound traffic whose source addresses are NOT from the
company's internal network; this is because the company’s network should never generate traffic
sourced from other different networks as it is possible someone from within the company is
spoofing another user on another network (Hosting, 2004). The routers should also be set to stop all
outbound and inbound traffic having addresses from private range of addresses as defined in the
address allocation for private Internet; such addresses are supposed to be used in internal networks
and so they should not be routed over networks using ISPs (Internet service providers). However,
ISPs can make mistakes so these should be blocked from the company’s networks; this requires
Windows automatic address blocking for private IPs should also be enabled. The routers also need
to set to block out all packets that are source -routed as this is a classical sign of an attack. Further,
the router should be set to block all fragment packets as well as broadcast packets, including all
directed broadcasts. This is because while broadcasts are of use within networks, they have no role
between networks. Fragments should not be accepted as they are usually not created and can be
used by attackers using Frag-routers to avoid detection in network intrusion.
Topic 5: Access Control
The procedure for working in secure areas in an ICT environment must first start be limiting
and managing physical access to these areas. The integrity of the secure must be maintained by;
1. Confirming and ensuring the access door to the secure area remains locked; before entering,
it must have been locked and should also be locked after finishing using the protected area.
2. The door to the protected area should never be left open while working inside the secure IT
area
3. Unsupervised access to the secure area such as by contractors doing maintenance should
never be allowed; and is such a permission must be given, such as for maintenance
technicians, then the administrator must supervise entry, use, and exit of the secure IT area
4. The secure IT area environment’s integrity must also be maintained;
5. Hazardous material, food, and drinks should never be brought into the secure IT area
6. Nothing should ever be plugged into UPS power outlets, be they vacuum cleaners or power
tools; they also should never be plugged into server racks, unused servers, and spare cables
power sources.
7. When installing cables in horizontal or vertical conduits, the fire protection systems must
either be installed or replaced

Running head: INFORMATION SECURITY TECHNOLOGIES 6
8. Actions must be limited to appropriate and authorized activities
9. Approved ITS RFCs (requests for change) must accompany any changes to the IT
infrastructure and systems
10. Entry into the secure area such as for checking the status of servers must be specified and
actions undertaken only for that specific task/ purpose
11. Equipment or cabinets for which one has no authority/ responsibility should never be
opened by the person using the secure IT area
12. Anything out of the ordinary that is observed in the secure IT area, such as UPS or servers
sounding the alarm must be reported immediately to the IT service desk
13. Great care must be taken whenever performing routine/ scheduled tasks in the secure IT area
not to disturb equipment nearby, for instance ladders should not ‘bump’ onto IT equipment
while being used.
14. The IT service desk must be immediately contacted whenever one accidentally damages,
disturbs, or unplugs any equipment in the secure IT area
Trash bins must be kept in isolated areas away from IT equipment and should be fastened so they do
not topple over. Further, the trash bins need to be lockable, or have a tight fitting lid and be airtight
so that the heat and cooling does not cause debris being blown into the air.
Access to the secure IT area must be logged
If the area is accessed using electronic keys, the key should be scanned always, even if
someone has already opened the door and accessed the room to maintain access logs
People accessing the secure IT area must sign in when commencing work and the time when the
work has been completed using either a log book or an electronic logging device
The reason for entry into the secure IT area must always be given including change requests (as
applicable) as well as the times when one entered and exited the secure IT room.
To reduce the risk/ dangers of individual PCs theft within an organization, the PCs can be locked/
attached on to the work desks and tables using a cable where the cable is wrapped around an
applicable area on the table and locked. A device like the Kensington desktop locking kit can be
used for this purpose. Every PC must have restricted log-in with a complex password required to
log in to the PC; for very sensitive computers, the log-in should incorporate a two step log-n process
where the person also receives a specific code through their mobile devices to enable them use their
strong password to log into the computer (Shinder, 2007)

Running head: INFORMATION SECURITY TECHNOLOGIES 7
Topic 6: Firewalls
Firewalls are put in place to stop malicious code from gaining access into a network; most
firewalls use the stateful packet inspection (SPI) system. The SPI works at the OSI model’s outer
layer and examines basic information within data packets, for instance, the packet footers and
headers and the process also determines if data packets belong to valid sessions and the firewall
determines whether the data packet should enter into the network or not. But SPI has several flaws,
and is essentially a basic ‘gatekeeper’ for checking headers and footers in data packets; as such it
does not provide information on what is contained in the packet and if its a part of a bigger
transmission. For this reason, Deep packet inspection (DPI) was introduced; apart from looking at
headers and footers, it also examines the content of data packets to seek out predefined criteria and
illegal statements. This makes it possible for the firewall to make decisions that are more informed
on whether to allow or block the packet from getting through based on this information (its
content). DPI therefore goes deeper into data packets and this makes it possible to make better
determination on the content of data packets before being allowed entry into a network (Tzu-Fang,
Nen-Fu & Hsiao-Ping, 2010). DPI disassembles incoming data packets, examines their data
(payload), and makes comparisons of this data with predefined criteria, before re-assembling the
data packet for transmission or alternatively, rejects it. DPI uses signature matching as well as
stealth payload detection to examine and validate data. However, DPI does much more than just
data packet examination; the information contained in the DPI is used by other network security
management tools to better understand network traffic. This helps unify the management of network
and application performance into a single event. This creates additional value for better
troubleshooting as a network manager can view a complete picture of network traffic and determine
causes of issues with network performance. The additional information offered by the DPI can be
used for network analytics, network trending, and for forensics. Therefore, DPI in firewall operation
serves the function of improving network security through increased and detailed examination and
detection, while also providing data and information for network performance management
Packet stream analysis refers to an evaluation of data streams (several data packets) to
evaluate the communication patterns in computer networks. Packet stream analysis entails the
capture and examination of data within a network to deduce information from the examined
communications patterns. A packet stream refers to a stream of network traffic having common
identifiers and is defined by traffic with a similar source IP, protocol, destination IP, source port as
well as a destination port. The packet stream analysis evaluates these parameters and if there is a
change, new flows are defined. This analysis is essential in troubleshooting problems within a
network, such as issues to do with congestion and help with intrusion detection (Asarin, Sabelfeld,

Running head: INFORMATION SECURITY TECHNOLOGIES 8
Meier & Gollmann, 2006). The packet stream analysis also helps rules for intrusion detection and
firewall rules; it is also important in undertaking threat and incident detection, all to ensure
networks remain safe and avid attacks such as denial of service, malware attacks, and cyber attacks
to computer networks; while also providing tools for better network management and
troubleshooting of responses. These processes are very resource intensive (memory and CPU)
because they involve capturing, analyzing and processing, and reassembly for large amounts of data
such as 10 Gigabits per second, which is a high throughput; this consumes a lot o CPU and memory
power

Running head: INFORMATION SECURITY TECHNOLOGIES 9
References
Asarin, E. A., Sabelfeld, A., Meier, J., & Gollmann, D. (2006). Computer Security - ESORICS
2006: 11th European Symposium on Research in Computer Security, Hamburg, Germany,
September 18-20, 2006, Proceedings. (Springer e-books.) Berlin Heidelberg: Springer-
Verlag.
Buchmann, J. A., Karatsiolis, E. & Wiesmaier, A. (2016). Introduction to Public Key
Infrastructures. Berlin, Springer-Verlag GmbH.
Hosting, P. F. (2004, June 24). How to defend against DDoS attacks. Retrieved August 26, 2017,
from http://www.computerworld.com/article/2564424/security0/how-to-defend-against-
ddos-attacks.html
Shinder, D. (2007). 10 physical security measures every organization should take. Retrieved August
26, 2017, from http://www.techrepublic.com/blog/10-things/10-physical-security-measures-
every-organization-should-take/
Sikorski, M., Honig, A., & Bejtlich, R. (2012). Practical malware analysis: The hands-on guide to
dissecting malicious software. San Francisco: No Starch Press.
Tzu-Fang, S., Nen-Fu, H., & Hsiao-Ping, L. (April 01, 2010). In-Depth Packet Inspection Using a
Hierarchical Pattern Matching Algorithm. Ieee Transactions on Dependable and Secure
Computing, 7, 2, 175-188.