Network Security: Assurance, Vulnerabilities, and Packet Analysis

This report identifies and assesses the security requirements of a company's ICT infrastructure, analyzing the network environment to propose adequate security solutions. It covers tracing options, acceptable traces, and Wireshark configuration. The report delves into administrative network management systems, IP network security algorithms, cryptography, encapsulation, encryption, enterprise security solutions, firewalls, network topologies, routing theories, system threats, and transaction protocols. Practical demonstrations include analyzing packets from HTTP, HTTPS, trace route, FTP, and POP3 traces, along with penetration testing. The report concludes with key observations and findings, providing a comprehensive overview of network security assurance.

Running head: INFORMATION SECURITY ASSURANCE
Information Security Assurance
Name of the Student
Name of the University
Author Note

1
INFORMATION SECURITY ASSURANCE
Summary
The purpose of this report is to identify and assess the security requirements of the
information communication technology (ICT) of a company and analyse the environment to
suggest adequate security solutions as also generate a report based on conducting traces on
the network. First the report identifies the tracing options, mentions the acceptable traces
talks about configuring Wireshark. Then the report discusses the network environment and
security needs of the company by talking about network management systems, network
security algorithms, purpose of cryptography, encapsulation and encryption, enterprise
security solutions, firewalls network topologies, routing theories, possible system threats and
transaction protocols. Then the report proceeds to the practical demonstration comprising
analysis of the packets of the various traces after which the report ends with concluding
notes.

2
INFORMATION SECURITY ASSURANCE
Table of Contents
Introduction................................................................................................................................4
Part A: Consultation...................................................................................................................4
Tracing Option.......................................................................................................................4
Acceptable Traces..................................................................................................................4
Wireshark Configuration........................................................................................................5
Part B: Research, Analysis and Reporting of Technical Information........................................5
Administrative Network Management System......................................................................5
Algorithms in IP network security.........................................................................................6
Purpose of cryptography in security systems.........................................................................6
Encapsulation and Encryption in Data Transmission............................................................7
Example of Enterprise solutions............................................................................................7
Firewall and Security Solutions.............................................................................................7
Common Network Topologies...............................................................................................7
Operations Network Management Systems...........................................................................8
Routing Theory......................................................................................................................8
System Threats.......................................................................................................................9
Transaction Protocols.............................................................................................................9
Part C: Analysing Packets..........................................................................................................9
HTTP Trace............................................................................................................................9
HTTPS Trace.......................................................................................................................12
Trace Route..........................................................................................................................17

3
INFORMATION SECURITY ASSURANCE
FTP Trace.............................................................................................................................18
POP3 Trace..........................................................................................................................21
Penetration Testing...............................................................................................................24
Conclusion................................................................................................................................25
Bibliography.............................................................................................................................27

4
INFORMATION SECURITY ASSURANCE
Introduction
The following report identifies and assesses the network security requirements of the
information communication technology or ICT of a company and analyses the network
environment in order to suggest adequate security solutions as also generate a report based on
conducting traces on the network. The report begins by identifying the tracing options,
mentions the acceptable traces and talks about configuring Wireshark. Then the report
discusses the network environment and security needs of the company by talking about
network management systems, network security algorithms, purpose of cryptography,
encapsulation and encryption, enterprise security solutions, firewalls network topologies,
routing theories, possible system threats and transaction protocols. Then the report moves
into the practical demonstration part comprising analysis of the packets of the various traces
after which the report ends with observations in concluding notes.
Part A: Consultation
Tracing Option
For performing the various types of traces, the free to use open source protocol
analyser software application called Wireshark is being used. This is because Wireshark is a
very powerful protocol analyser tool that can be used to perform and analyse all kinds of
traces be it HTTPS, FTP, trace route, POP3 trace, or trace of attacks on the network. It lists
the communication packets of all kinds of protocols and offers a segmented and organized
view of the respective details in different parts like IP (Internet Protocol), ICMP (Internet
Control Message Protocol), Frame and Ethernet.
Acceptable Traces
The acceptable traces for the project is found to be gameaddicts.net for the HTTP
trace. This is because the chosen site does not have a SSL certificate. The websites regularly

5
INFORMATION SECURITY ASSURANCE
visited by the company are amazon.com.au, inria.fr, gameaddicts.net, gamerval.com to name
a few. The website chosen for HTTPS trace is https://amazon.com.au. This is because the
website uses a SSL certificate. A different website www.inria.fr is chosen for conducting the
trace route process. All these activities are recorded with the help of the protocol analyser
called Wireshark so that the captured packets of the protocols involved as well as the
respective details can be analysed.
Wireshark Configuration
The configuration of the Wireshark tool is fairly simple. When Wireshark is launched,
the application lists down an array of networks present within the system1. Among these
networks present in the system, the most likely network that is actively used for the tracing
activities is the Ethernet as in most cases systems use their Ethernet network to access the
Internet. Therefore the Ethernet network needs to be selected. After that the recording can be
started by either clicking the Wireshark icon or even by clicking start from the options that
are available in the capture menu on the menu bar.
Part B: Research, Analysis and Reporting of Technical Information
Administrative Network Management System
Administrative Network Management Systems are those applications or application
sets which help network administrators in managing the framework of the network. These
applications can be used in monitoring software as well as hardware components. In general
data gets recorded from the remote points of the network to help conduct centralised
reporting to system administrators.
1 Alshammari, Fayzah. "Towards an Evaluation of a Recommended Tor Browser Configuration in Light of
Website Fingerprinting Attacks." PhD diss., Université d'Ottawa/University of Ottawa, 2017.

6
INFORMATION SECURITY ASSURANCE
Algorithms in IP network security
IPsec or Internet Protocol Security refers to the secure suite of networking protocols.
Here a security association is used the parties where communicating parties set up shared
attributes for security which are generally keys an algorithms. The algorithms are mainly
cryptographic algorithms and are listed below:
HMAC-SHA1/SHA2: This algorithm is used to ensure integrity, protection and
authentication purposes.
TripleDES-CBC: This algorithm is used for ensuring confidentiality purposes
AES-CBC: This algorithm is also used for the purpose of ensuring confidentiality
AES-GCM: This algorithm is used for setting up security to efficiently provide both
authentication and confidentiality.
ChaCha + Poly1305: This algorithm is also used for establishing security to ensure both
authentication and confidentiality in an efficient manner.
Purpose of cryptography in security systems
Cryptography is used for the purpose of protecting data when they are transmitted in
through unsecured networks2. Cryptographic data encryption refers to the process of hiding
plaintext data or encrypting it which results to creation of an altered text called the cipher text
which do not reveal any original inputs. This is commonly used in almost all business
organizations.
2 Kumar, Shyam Nandan. "Review on network security and cryptography." International Transaction of
Electrical and Computer Engineers System 3, no. 1 (2015): 1-11.

7
INFORMATION SECURITY ASSURANCE
Encapsulation and Encryption in Data Transmission
Encapsulation concerns wrapping data into some sort of packets – usually a header
and a trailer. Encryption simply involves changing the data while having the ability to retain
the original data.
Encrypting passwords prevents the exact system password from being visible to all
actors over the network.
Example of Enterprise solutions
Cisco DNA or Digital Network Architecture is the enterprise network security
solution to be installed in the company network. This is the only network security solution in
the industry to have the ability of finding threats existing in traffic which is already
encrypted.
Firewall and Security Solutions
Firewalls can be hardware devices or even programs which filter all the information
arriving via the Internet and onto the private network of users3. If such filters end up flagging
some incoming packets of data, they are not allowed. Other than that real time protection
from antivirus and antimalware solutions can also help the company securing their network.
Common Network Topologies
The networking topologies commonly used in businesses and enterprises are Local
Area Networks (LAN), Wide Area Networks (WAN) and Wireless Local Area Networks
(WLAN)4. Both the other two types of network topologies are extended implementations of
LAN. WAN is used as a LAN network of other LAN networks spread across multiple regions
3 Malmgren, Andreas, and Simon Persson. "A comparative study of Palo Alto Networks and Juniper Networks
next-generation firewalls for a small enterprise network." (2016).
4 Sunny, Albert, Sumankumar Panchal, Nikhil Vidhani, Subhashini Krishnasamy, S. V. R. Anand, Malati
Hegde, Joy Kuri, and Anurag Kumar. "ADWISERv2: A Plug-and-play Controller for Managing TCP Transfers
in IEEE~ 802.11 Infrastructure WLANs with Multiple Access Points." arXiv preprint arXiv:1609.04197 (2016).

8
INFORMATION SECURITY ASSURANCE
and WLANs involve use of wireless routers and access points for providing network access
to laptops and smartphones.
Operations Network Management Systems
Network management systems are those that can viewed as primary consoles used by
network operators for detecting faults in the network infrastructure. These systems allow
operators in quickly detecting issues on the network so as to proactively work on resolving
the problem. They also offer graphical network maps for network operators to rely on to
know about the operating status of critical elements in the network which can include routers,
switches and even circuits.
Routing Theory
IP Routing concerns the use of a set of protocols for determining the path for data
packets to follow so as to travel through multiple networks from the source to the
destination5. Several routers are used for routing the Data from their source to the destination
and the routing protocols help the routers in building forwarding tables which correlate the
next hop addresses with the destinations.
The various types of routing protocols are:
o RIP (Routing Information Protocol)
o OSPF (Open Shortest Path First)
o BGP (Border Gateway Protocol)
o IS-IS (Intermediate System - Intermediate System)
5 Kawano, Ryuta, Ryota Yasudo, Hiroki Matsutani, Michihiro Koibuchi, and Hideharu Amano. "HiRy: An
advanced theory on design of deadlock-free adaptive routing for arbitrary topologies." In 2017 IEEE 23rd
International Conference on Parallel and Distributed Systems (ICPADS), pp. 664-673. IEEE, 2017.

9
INFORMATION SECURITY ASSURANCE
System Threats
The threats to the systems of the company are likely to occur from exploits used by
cyber criminals to sabotage the network or steal sensitive information. These threats can
mainly be remote attacks, client side attacks, blind side attacks, social engineering attacks,
denial of service (DoS) and man in the middle (MITM) attacks.
Transaction Protocols
The transaction protocol WS-Atomic Transaction and the coordination protocol WS-
Coordination is implemented by the WCF or Windows Communication Foundation.
Applications and transaction managers are the two levels at which interoperability is required
on the protocol specifications.
Part C: Analysing Packets
HTTP Trace
Website for HTTP Trace

10
INFORMATION SECURITY ASSURANCE
Verifying use of HTTP
The website visited for this tracing activity is gameaddicts.net. In this website the
various review articles on games were browsed and read. The IP address for the website
visited is 182.156.217.124.

11
INFORMATION SECURITY ASSURANCE
Packet Capture
The above screenshot shows the recording of the HTTP trace in Wireshark. The IP
address for the website visited is 182.156.217.124.

12
INFORMATION SECURITY ASSURANCE
HTTPS Trace
Website for HTTPS Trace
Verifying SSL of website
The website visited for this tracing activity is amazon.com.au

13
INFORMATION SECURITY ASSURANCE
Packet Capture
The above screenshot shows the recording of the HTTPS trace in Wireshark. The
source IP address of the website is 172.217.160.142. The particular packet is selected and the
IP part is expanded. It can be noticed that it is a form of IP version 4 communication where
the protocol of the packet used is TCP (6). The total length of the packet is 52 while that of
the header is 20 bytes. It has a time to live of 120. The IP address used by the DNS protocol
packets of the website is 8.8.8.8.

14
INFORMATION SECURITY ASSURANCE
Domain Names
The DNS (domain name system) query responds within the time period 89 and prints
the domain name along with the type of IP address.
The name of the certificate issuing authority DigiCert Global CA G2. The encryption
algorithm used here is SHA256RSA asymmetric key algorithm. The public key is
30 82 01 0a 02 82 01 01 00 bf e0 8f 49 b2 78 b8 3f fe 1e 57 f7 03 16 30 44 84 4b d4 0a
c7 01 cf 23 fd c5 39 b3 cd 7e b4 d6 8a 04 67 e1 ce f1 7f 15 c4 b8 89 1b 75 04 d8 da d3
1d bb a0 09 89 c5 05 d0 0c 10 cb 7d af dd ec f4 da d5 20 2a 11 0f 33 9d 78 4f 22 91 0d
07 8b c7 ea a5 05 43 92 9f 8f 40 32 3a 87 05 01 e2 79 dd 59 ac 47 4f d1 3e 5b 90 b6 b6
b5 7c 6d a4 69 6d b8 5a 07 e9 98 b9 ee 3f a3 d2 14 88 d3 99 3e 1e b7 f7 1a d9 43 15 aa
77 60 dc e2 63 0d 93 00 09 97 1c c3 83 46 d6 16 9d 84 1d e6 c7 20 95 12 f0 40 b4 a8 a4
3f 73 52 bc 23 3f e3 c1 f7 8c 04 b2 63 0f 7f da 43 4f 10 22 8e e5 32 28 89 00 0d f4 1f
f4 b8 ea 8a 38 0c 55 1c 2b c8 11 e6 16 5d 60 a6 eb d7 63 90 5e 94 d8 2b 71 ac 04 11 c6
36 7e 95 03 2b 86 b6 b8 3b 2f 58 da 77 a7 c7 e6 3c 4b 35 71 d2 d7 d4 d9 ab 25 be b1 bd
c1 63 e4 37 02 03 01 00 01

15
INFORMATION SECURITY ASSURANCE
The size of the public key is 2048 Bits. The certificate is valid from 01.04.2019 to
18.12.2019.
The cipher suite supported by the browser is the following:
0x8a8a GREASE_i
0xc02b TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
0xc02f TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
0xc02c TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
0xc030 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
0xcca9 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
0xcca8 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
0xcc14 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_non_iana
0xcc13 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_non_iana
0xc013 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
0xc014 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
0x009c TLS_RSA_WITH_AES_128_GCM_SHA256
0x009d TLS_RSA_WITH_AES_256_GCM_SHA384
0x002f TLS_RSA_WITH_AES_128_CBC_SHA
0x0035 TLS_RSA_WITH_AES_256_CBC_SHA
0x000a TLS_RSA_WITH_3DES_EDE_CBC_SHA
The cipher suite supported by the server is the following:

16
INFORMATION SECURITY ASSURANCE
v1
ee4bbdb775ce60bae142691fabe19e66a30f7e5fb072d88300c47b897aa8fdcb
02 April 2019 04:58:18
SHA256
ECDSA
304402201bfffc1f8ecf3c1342bc7740145c1c7740ba6334db76188c5af1843aa79e348e02203c
7bf580ede445d883ea40a2b573dcd95f14735d68afe00b0250064f1975683c
v1
8775bfe7597cf88c43995fbdf36eff568d475636ff4ab560c1b4eaff5ea0830f
02 April 2019 04:58:19
SHA256
ECDSA
304402202ae629e6e4c4ea79c05d96ce2ffa1a83b9916b8e3e65d41ca4591cb1a0ac188502201a
e0a8d844609d64070fedb35bf6829459592517def3c445328e6b3c70cd5f7a

17
INFORMATION SECURITY ASSURANCE
Trace Route
Trace route of www.inria.fr
The trace route activity is being performed on the website www.inria.fr using the
native trace route functionality of Windows 10. The screenshot shows the full trace route of
the website. The IP addresses found during the trace route from the source to the destination
are 10.10.63.254, 10.10.60.1, 221.105.98.14, 14.98.105.221, 10.117.149.145,
115.113.172.125, 172.23.183.121, 180.87.38.5, 180.87.38.126, 80.231.217.6, 80.231.153.49,
80.231.153.202, 77.67.123.206, 193.51.177.107, 193.51.184.177, 192.93.122.19,
128.93.162.84

18
INFORMATION SECURITY ASSURANCE
FTP Trace
Pinging the website for FTP trace
The domain gamervale.com is pinged for the activity of FTP trace and the hostname
is ftp.gamervale.com. The IP address of the domain host is found to be 111.118.215.154
while that of the source host is 10.10.63.7. This suggests that the remote site exists.
Establishing connection to a website for FTP trace. The connection is established
using the FTP client called Filezilla. For ensuring FTP trace, the hostname ftp.gamervale.com
is used.

19
INFORMATION SECURITY ASSURANCE
The activity of FTP trace gets recorded in Wireshark. FTP uses the TCP protocol. The
port used is 21 such that it acts as the source port in FTP packet and as the destination port in
the corresponding TCP packet.

20
INFORMATION SECURITY ASSURANCE
FTP field information
The FTP field shows detailed FTP information regarding the FTP protocol packet.
From the trace it is clear that the user performing the trace is the only user on the domain at
the time period.

21
INFORMATION SECURITY ASSURANCE
POP3 Trace
Configuring Gmail server in Thunderbird
In thunderbird the server settings are being configured for Gmail POP3 trace.
The username used is [e-mail]
Password: abcXYZ321
User mail client setup

22
INFORMATION SECURITY ASSURANCE
A total of 60497 emails have been received.
The first email to this account is as follows
From: [e-mail]
Subject: Gmail is different. Here's what you need to know.
To: Me (user)

23
INFORMATION SECURITY ASSURANCE
Wireshark recording of POP3 trace
From the earlier screenshot, it is clear that port 995 is being used for POP3 trace with
TLS security enabled. Therefore, the TLS packets with source port 995 represents the POP3
packets.

24
INFORMATION SECURITY ASSURANCE
Penetration Testing
The Wireshark recording is launched.

25
INFORMATION SECURITY ASSURANCE
The exploit chosen is samba usermap_script and the IP address and port is configured
automatically before launching the exploit. The Metasploit console terminal shows that
“Exploit running as background job”.
Local host IP address: 192.168.116.129
Local Port: 29163
Remote host IP address: 192.168.116.1
Remote Port: 139
In Wireshark gets recorded. It can be clearly seen that the local host 192.168.116.129 is
sending payload to remote client 192.168.116.1 on the destination port 139.
Conclusion
In conclusion the above report succeeds in identifying and assessing the network
security requirements of the information communication technology or ICT of a company

26
INFORMATION SECURITY ASSURANCE
and analyses the network environment in order to suggest adequate security solutions as also
generate a report based on conducting traces on the network. The report is observed to
identify the tracing options, mentions the acceptable traces and talks about configuring
Wireshark. Then the report discusses the network environment and security needs of the
company by talking about network management systems, network security algorithms,
purpose of cryptography, encapsulation and encryption, enterprise security solutions,
firewalls network topologies, routing theories, possible system threats and transaction
protocols. Then the report moves into the practical demonstration part comprising analysis of
the packets of the various traces.

27
INFORMATION SECURITY ASSURANCE
Bibliography
Alshammari, Fayzah. "Towards an Evaluation of a Recommended Tor Browser
Configuration in Light of Website Fingerprinting Attacks." PhD diss., Université
d'Ottawa/University of Ottawa, 2017.
Kawano, Ryuta, Ryota Yasudo, Hiroki Matsutani, Michihiro Koibuchi, and Hideharu Amano.
"HiRy: An advanced theory on design of deadlock-free adaptive routing for arbitrary
topologies." In 2017 IEEE 23rd International Conference on Parallel and Distributed
Systems (ICPADS), pp. 664-673. IEEE, 2017.
Kumar, Shyam Nandan. "Review on network security and cryptography." International
Transaction of Electrical and Computer Engineers System 3, no. 1 (2015): 1-11.
Malmgren, Andreas, and Simon Persson. "A comparative study of Palo Alto Networks and
Juniper Networks next-generation firewalls for a small enterprise network." (2016).
Sunny, Albert, Sumankumar Panchal, Nikhil Vidhani, Subhashini Krishnasamy, S. V. R.
Anand, Malati Hegde, Joy Kuri, and Anurag Kumar. "ADWISERv2: A Plug-and-play
Controller for Managing TCP Transfers in IEEE~ 802.11 Infrastructure WLANs with
Multiple Access Points." arXiv preprint arXiv:1609.04197 (2016).