Network Security

Network Security

1. Risk Management

   • threads can cause damage
     • vulnerabilities increase impact of threat
   • Risk the possibilities of vulnerability being used
     • Control
       • evaluate risk
       • detect
       • prevent
       • correct action
     • risk analysis
       • qualitative - assessing importance of elements in system
       • Goals
         • identify important assests
         • identify threats + vulnerabilites
         • Ultimately be cost effective
         • take into account potential danger
       • Quantitative - assigning values to elements of risk assessing process
         • looking to achieve
           • assests value
           • frequency of threat
           • probability of threat
           • cost to safeguard + prevent

2. Pentesting - simulating an attack on a system to see how secure it is

   • security audit - an in dept assessment for an risk vulnerability
     • cost
     • firewall
     • networks
   • external testing
     • curious employee
     • annoyed administator
   • internal testing
     • black box
     • white box
     • grey box
   • techniques
     • war driving
     • packet scanning
     • vulnerability scanning
     • loopback approach
     • scanning networks
     • brunte force
     • log reviews
     • password cracking

3. Crypography - Encryption often used to send info between two parties while ensuring that any third party can't eavesdrop on data

   • Public Key encryption - messages encrypted using public key + decrypt using private key
     • Public Key
     • Private Key
   • Caesars Cipher
     • language redundancy
     • electronic codebook ECB
     • Cipher Block Changing CBS
     • Festal Cipher Scheme FCS
     • Data Encryption Standard DES
     • Shifting of letters to display coded message

4. Access Control Techniques

   • Identification
   • Authentication - the method where we check to see if identity is valid
     • metrics
       • Facial Recognition
       • Eye Scan
       • finger print scan
     • username
     • password
     • security question
   • Authorization - checks came back and user granted access
     • Concepts
       • authorization creep
       • list of access concepts
       • Default to no access
       • need to know principle