CYS406 · Annotated SlidesChapter 10 — Network Security Protocols
Chapter 10 · Annotated slides

Network Security Protocols

RADIUS and TACACS+ for AAA, Kerberos, email security with PGP and S/MIME, HTTPS, TLS and SSL, and IPsec.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: Slide 1
Exam weight Low
    Slide 2: Module Objectives
    Exam weight Low
      Slide 3: Module Flow
      Exam weight Low
        Slide 4: Network Security Controls: Technical Security Controls
        Exam weight Low
          Slide 5: Network Security Protocols
          Exam weight Low
            Slide 6: Network Security Protocols
            Exam weight Low
              Slide 7: Network Security Protocols
              Exam weight Low
                Slide 8: Remote Authentication Dial-in User Service (RADIUS)
                Exam weight Low
                1. RADIUS: centralized AAA over UDP (1812/1813); encrypts only the password.
                Slide 9: Remote Authentication Dial-in User Service (RADIUS) (Cont’d)
                Exam weight Low
                  Slide 10: Remote Authentication Dial-in User Service (RADIUS) (Cont’d)
                  Exam weight Low
                    Slide 11: Terminal Access Controller Access Control System Plus (TACACS+)
                    Exam weight High
                    1. TACACS+ (Cisco): TCP 49, encrypts the whole body, separates authentication, authorization and accounting.
                    🎯 How this can come up · 1 question
                    MCQ

                    Compared with RADIUS, TACACS+:

                    Slide 12: Terminal Access Controller Access Control System Plus (TACACS+)
                    Exam weight Low
                      Slide 13: RADIUS vs TACACS+
                      Exam weight Low
                        Slide 14: Kerberos
                        Exam weight High
                        1. Kerberos: ticket-based authentication with a KDC (AS + TGS); uses symmetric keys and timestamps; needs synchronized clocks.
                        🎯 How this can come up · 1 question
                        MCQ

                        Kerberos issues users a:

                        Slide 15: Pretty Good Privacy (PGP)
                        Exam weight Low
                        1. PGP: email/file confidentiality, integrity, authentication; web of trust.
                        Slide 16: Pretty Good Privacy (PGP)
                        Exam weight Low
                          Slide 17: Secure/Multipurpose Internet Mail Extensions (S/MIME)
                          Exam weight High
                          1. S/MIME: secure email using X.509 certificates (hierarchical CA trust).
                          Memory trickPGP = web of trust; S/MIME = certificate authorities.
                          Slide 18: Secure/Multipurpose Internet Mail Extensions (S/MIME)
                          Exam weight Low
                            Slide 19: Secure/Multipurpose Internet Mail Extensions (S/MIME) (Cont’d)
                            Exam weight Low
                              Slide 20: Differences between PGP and S/MIME
                              Exam weight Low
                                Slide 21: Secure Hypertext Transfer Protocol (S-HTTP)
                                Exam weight Low
                                1. HTTPS = HTTP over TLS (port 443).
                                Slide 22: Hypertext Transfer Protocol Secure (HTTPS)
                                Exam weight Low
                                  Slide 23: Hypertext Transfer Protocol Secure (HTTPS)
                                  Exam weight Low
                                    Slide 24: Transport Layer Security (TLS)
                                    Exam weight High
                                    1. TLS (successor to SSL): handshake negotiates ciphers, authenticates the server with a certificate, and derives session keys.
                                    🎯 How this can come up · 1 question
                                    True / False

                                    SSL is still considered secure and preferred over TLS.

                                    Slide 25: Secure Sockets Layer (SSL)
                                    Exam weight Low

                                      Secure Sockets Layer (SSL)

                                      Client Hello message (includes SSL version, randomly generated data, encryption algorithms, session

                                      ID, key exchange algorithms, compression algorithms, and MAC algorithms)

                                      Sends a Server Hello Done message

                                      Determines the SSL version and encryption algorithms to be used for the communication; sends Server

                                      Hello message (Session ID) and Certificate message (local certificate)

                                      Verifies the Digital certificate; generates a random premaster secret (Encrypted with server's public key) and sends Client Key Exchange message with the premaster secret

                                      Sends a Change Cipher Spec message and also sends Finished message (hash of handshake message)

                                      Hash value is calculated for the exchanged handshake messages and then compared to the hash value received from the client; If the two match, the key and cipher suite negotiation succeeds. Sends a Change Cipher Spec message and

                                      also sends Finished message (hash of handshake message)

                                      Secure Sockets Layer (SSL)
                                      26
                                      Exam weight Low
                                        Slide 27: Internet Protocol Security (IPsec)
                                        Exam weight High
                                        1. IPsec: network-layer security. AH = integrity/authentication (no encryption); ESP = encryption (+ integrity). Transport mode protects the payload; tunnel mode protects the whole packet.
                                        🎯 How this can come up · 2 questions
                                        MCQ

                                        Which IPsec protocol provides encryption?

                                        MCQ

                                        IPsec mode that encapsulates the entire original IP packet (used for site-to-site VPNs):

                                        Slide 28: Internet Protocol Security (IPsec)
                                        Exam weight Low
                                          Slide 29: Module Summary
                                          Exam weight Low