Network Security Report: Protocols, Incidents, Cryptography Analysis

This report provides a comprehensive overview of network security, focusing on evolving network communication protocols and the increasing number of associated incidents. It examines various aspects of network security, including network protocols, cryptographic techniques, network endpoints, and infrastructure. The report highlights common network security incidents such as TCP blind spoofing, SYN flooding, session hijacking, and man-in-the-middle attacks, as well as vulnerabilities in web browsers, cookie poisoning, cross-site scripting, DNS service attacks, and replay attacks. It also covers attacks on endpoint devices like LAN attacks, MAC overflow, and STP manipulation. Furthermore, the report discusses the role of Network Security Monitoring (NSM) tools in raising alerts and aiding in intrusion analysis. The report covers topics such as cryptography and PKI, endpoint security, and intrusion analysis, offering insights into how to identify and mitigate network threats. The report emphasizes the importance of understanding network behavior and using tools like Wireshark and Security Onion for analysis and monitoring. It concludes by summarizing the key findings and reinforcing the importance of network security in the face of evolving threats.

Running head: NETWORK SECURITY
Network Security
Name of the Student
Name of the University
Author Note

1NETWORK SECURITY
Executive Summary
The importance of network security in recent years has grown manifolds. With every
advancement in network communications, the number of network incidents have evolved.
This report is to focus on these rapidly growing network communication protocols and
wishes to touch on how the network threats can be dealt with. After this the report is to focus
on other security components and incidents pertaining to networking. These can include
cryptographic techniques, network endpoints and infrastructure and virtual machines. The
incidents can include TCP blind spoofing, SYN Flooding, Session Hijacking, Man in the
Middle attacks or MITM, web browser weaknesses, cookie poisoning, cross site scripting,
DNS service and Replay attacks. Attacks to Endpoint devices can include LAN attacks, MAC
overflow or STP manipulation. Network Security Monitoring (NSM) tools help with raising
alerts related to network security. After this the report ends with conclusions.

2NETWORK SECURITY
Table of Contents
Introduction................................................................................................................................3
Chapter 4 Summary....................................................................................................................3
Network Protocols and Security.............................................................................................3
Summary of Other Chapters.......................................................................................................4
Chapter 9: Cryptography and PKI..........................................................................................4
Chapter 10: Endpoint Security...............................................................................................5
Chapter 12: Intrusion Analysis...............................................................................................6
Questions on Chapters................................................................................................................7
Conclusion..................................................................................................................................7
References..................................................................................................................................8

3NETWORK SECURITY
Introduction
The below report tries to highlight the importance of network security when it comes
to evolving network communications protocols (Contreras-Castillo, Zeadally and Guerrero-
Ibañez 2017). The report shows how the number of network incidents is forever increasing.
This report focuses on the rapidly growing network communication protocols and touches on
how the network threats can be dealt with (Biryukov, Dinu and Le Corre 2017). After this the
report focuses on other security components and incidents pertaining to networking
(O'Mahony, Harris and Murphy 2019). They include cryptographic techniques, network
endpoints and infrastructure and virtual machines. The network security incidents are TCP
blind spoofing, SYN Flooding, Session Hijacking, Man in the Middle attacks or MITM, web
browser weaknesses, cookie poisoning, cross site scripting, DNS service and Replay attacks.
Attacks to Endpoint devices are LAN attacks, MAC overflow or STP manipulation (Estrada,
Lanson and Kaldawy 2019). Network Security Monitoring (NSM) tools help with raising
alerts related to network security. After this the report ends with conclusions.
Chapter 4 Summary
Network Protocols and Security
The cyber security analysts try to identify various security incidents affecting the
network systems by going through the network log records. This also includes reviewing the
packets that have been transmitted through the network to and from several source and
destination computers. Here the analysts use the IP addresses to identify the different hosts
that attackers are found to use when trying to affect the target system. The analysts also
monitor the protocols that have been used in these communications (Tomić and McCann
2017). The TCP traces of these communications are then viewed where the analysts can
identify each hop and thereby track the location of the attacker. Applications that help the

4NETWORK SECURITY
cyber analysts perform these tasks can be protocol analysers like Wireshark or Microsoft
Message Analyser and tracing tools like PingPlotter. The location and hop addresses can also
be viewed by performing trace route commands from command prompt. To effectively and
efficiently understand any abnormal activities on the network, the analysts are first required
to acquire a thorough understanding on the network. This includes getting to know the
manner in which data normally travels through the network, the communication protocol that
are generally used and the private networks which are typically involved. The different kinds
of existing networks can be private networks and public networks. The largest network in
existence is the Internet. The Internet serves as a collection of multiple public and private
networks. The transfer of files among clients or between clients and servers can is made
possible by the File Transfer Protocol or FTP. To secure such data transmissions, analysts can
make use of SFTP or Secure File Transfer Protocol. The client computers have different
applications installed like web browsers, mailing clients and file transfer applications. These
applications help clients from remote networks to access the web or mailing domains hosted
in other networks.
Summary of Other Chapters
Chapter 9: Cryptography and PKI
During the initial phase of drafting Internet standards few people thought about
developing standards that can help the network remain protected from various threat actors.
The TCP/IP is the networking protocol that is generally used to set up communications
among different networks. This protocol is vulnerable to a wide range of network
vulnerabilities such as TCP Blind Spoofing, SYN Flooding, Session Hijacking, Man in the
Middle or MITM attacks, web browser weaknesses, cookie poisoning as also more severe
attacks like Cross site scripting, DNS service and Replay attacks. To protect from such kinds
of security vulnerabilities, several cryptographic techniques in order to keep the data secure

5NETWORK SECURITY
and private. But Cryptography can also be used by the attackers in hiding their actions from
the analysts thus making network monitoring a more challenging process. Among the various
cryptographic techniques and are class activity through creation of codes. Use of secret codes
is an ancient practice carried out by Greeks, Romans, Spartans and even the French. Many
advanced methods of encryption are available today which help in encoding messages. To
secure the communications of public and private networks, different schemes can be used.
These can be use of firewalls (both applications and devices), forming perimeter networks
through specific arrangement of routers and firewall devices to ensure Intrusion Prevention
System (IPS) and Intrusion Detection System or IDS. Other techniques can be use of VLANs
and then specifying permissions via Access Control Lists of ACL. The routers can also use
encrypted tunnels through IPsec VPN to secure the connections (Salman 2017). One of the
primary encryption techniques is the use of Public Key Infrastructure or PKI (Dai, Shulman
and Waidner 2018). This involves use of hardware and software procedures for creating,
managing, distributing as well as revoking of public keys. Securing communications through
cryptology however, can involve both cryptography and cryptanalysis. While cryptography
concerns development of codes for private use, cryptanalysis deals with breaking these codes
or trying to exploit the weaknesses of cryptographic techniques.
Chapter 10: Endpoint Security
The external network attacks on enterprise networks that are commonly covered by
the media agencies generally include the Denial of Service or DoS attacks on the networks of
organizations. These attacks are meant to degrade, halt or jeopardize company services or
access by public to company resources and domains being hosted. The attacks can also be
used to compromise company services in order to spoil their reputation. The attacks are
sometimes even conducted to infiltrate the company servers and databases to obtain sensitive
information of client leading to irreparable losses. The best methods to protect company

6NETWORK SECURITY
networks from such kind of attacks are setting up of DMZ or perimeter networks to crate IPS
and IDS services for accessing the network from outside. It is also suggested to have the
routers connected through hardware based IPSec VPN tunnels for router hardening (El
Kamoun, Bahnasse and Bensalah 2017). A common example of next generation firewall for
protecting network services is making use of Cisco Adaptive Security Appliance (ASA) that
help with configuring permissions for different network segments (Hamdan 2016). The
network structure typically includes two different LAN components. These are Network
Endpoints and Network Infrastructure (Zave and Rexford 2018). The network endpoints
primarily comprise of individual host devices like the laptops, desktops, servers, IP phones,
printers as also devices which may become vulnerable to malware attacks. Network
infrastructure on the other hand refers to the network interconnect of all the above mentioned
devices that is generally built with a range of switching devices, wireless access points and
VoIP phones. Such networks can get exposed to LAN specific network attacks like MAC
overflow, spoofing, DHCP attacks, LAN storm, STP manipulation as also attacks to VLANs.
Chapter 12: Intrusion Analysis
The process of intrusion analysis deals with the manner in which the alerts relating to
network security are forwarded to the concerned individuals. These are the cyber security
analysts and network administrators who evaluate and escalate the reported network incidents
along with the respective evidences. To ensure secure processing of tasks the security
analysts and network administrators encourage the use of multiple isolated virtual machines.
A popular application that offers this feature is Security Onion (Bezborodov 2016). It is an
open source package of tools and utilities which provide Network Security Monitoring
services and are generally run in the Ubuntu based distribution of Linux operating systems.
This application package can be installed in a standalone manner as also in the form of sensor
and server platform. Part of Security Onion components are owned and maintained by

7NETWORK SECURITY
industry leading corporations like Riverbend Technologies and Cisco and is still made
available to the public as an open source solution (Chou and Jones 2018). The various
detection tools that can be used for collecting Alert type Data for different needs and
purposes are the CapME web application, Snort intrusion detection system (IDS), bro
intrusion detection system which uses a behaviour oriented approach, the Host based IDS
OSSEC and a network based IDS called Suricata which uses a signature oriented approach.
Suricata can harness the parallelised multithreaded compute feature of GPUs to improve
performance. Other than that there are network analysis tools like Sguil, ELSA and
Wireshark. Security Onion is found to integrate all these tools.
Questions on Chapters
What protocol is used to facilitate file transfer? How is it made secure?
Name applications and commands to trace network activity.
Why is cryptography viewed as a double-edged sword?
What is meant by a network endpoint? How are they interconnected?
What are Network Security Monitoring Tools? Name a software package that involves them.
Conclusion
To conclude, the above report succeeds in highlighting the importance of network
security with every advancement in network communications protocols. The report is
observed to suggest that the number of network incidents is always increasing. This report
focuses on the fast-growing network communication protocols and discusses how the
associated network threats should be dealt with. Thereafter the report focuses on other
security components and incidents pertaining to networking. They include cryptographic
techniques, network endpoints and infrastructure and virtual machines. The network security

8NETWORK SECURITY
incidents are TCP blind spoofing, SYN Flooding, Session Hijacking, Man in the Middle
attacks or MITM, web browser weaknesses, cookie poisoning, cross site scripting, DNS
service and Replay attacks. Attacks to Endpoint devices are LAN attacks, MAC overflow or
STP manipulation. Network Security Monitoring (NSM) tools help with raising alerts related
to network security. After summarising these findings, the report comes to an end.
References
Bezborodov, S., 2016. Intrusion Detection Systems and Intrusion Prevention System with
Snort provided by Security Onion.
Biryukov, A., Dinu, D. and Le Corre, Y., 2017, July. Side-channel attacks meet secure
network protocols. In International Conference on Applied Cryptography and Network
Security (pp. 435-454). Springer, Cham.
Chou, T.S. and Jones, J., 2018, September. Developing and Evaluating an Experimental
Learning Environment for Cyber Security Education. In Proceedings of the 19th Annual SIG
Conference on Information Technology Education (pp. 92-97).
Contreras-Castillo, J., Zeadally, S. and Guerrero-Ibañez, J.A., 2017. Internet of vehicles:
architecture, protocols, and security. IEEE Internet of Things Journal, 5(5), pp.3701-3709.
Dai, T., Shulman, H. and Waidner, M., 2018, October. Off-Path Attacks Against PKI. In
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications
Security (pp. 2213-2215).
El Kamoun, N., Bahnasse, A. and Bensalah, F., 2017. Evaluation of the Scalability of the
Protected Multipoint Dynamic VPN by IPsec in a WiMax Network. International Journal of
Computer Science and Network Secuirty (IJCSNS), 17(12), p.108.

9NETWORK SECURITY
Estrada, J., Lanson, J.P. and Kaldawy, R., 2019. Host-Based Traffic Engineering: Network
Endpoints with the Capabilities of SDN-Enabled Switches.
Hamdan, M., 2016. Cisco ASA firewall commands line technical guide.
O'Mahony, G.D., Harris, P.J. and Murphy, C.C., 2019, June. Developing Low-Cost Testbeds
for Enhancing Security Techniques in Wireless Sensor Network Protocols. In 2019 30th Irish
Signals and Systems Conference (ISSC) (pp. 1-6). IEEE.
Salman, F.A., 2017. Implementation of IPsec-VPN tunneling using GNS3. Indonesian
Journal of Electrical Engineering and Computer Science, 7(3), pp.855-860.
Tomić, I. and McCann, J.A., 2017. A survey of potential security issues in existing wireless
sensor network protocols. IEEE Internet of Things Journal, 4(6), pp.1910-1923.
Zave, P. and Rexford, J., 2018. 1 Security provided by endpoints.