3.1 Secure Protocols

Question 1

• SRTP
– Secure Real-Time Transport Protocol / Secure RTP
• Adds security features to RTP
– Keep conversations private
• Encryption
– Uses AES to encrypt the voice/video flow
• Authentication, integrity, and replay protection
– HMAC-SHA1 - Hash-based message authentication
code using SHA1

Answer 1

Voice and video

Question 2

• Classic NTP has no security features
– Exploited as amplifiers in DDoS attacks
– NTP has been around prior to 1985
• NTPsec
– Secure network time protocol
– Began development in June of 2015
• Cleaned up the code base
– Fixed a number of vulnerabilities

Answer 2

Time synchronization

Question 3

• S/MIME
– Secure/Multipurpose Internet Mail Extensions
– Public key encryption and digital signing
of mail content
– Requires a PKI or similar organization of keys
• Secure POP and Secure IMAP
– Use a STARTTLS extension to encrypt POP3 with
SSL or use IMAP with SSL
• SSL/TLS
– If the mail is browser based, always encrypt with SSL

Answer 3

Email

Question 4

• SSL/TLS
– Secure Sockets Layer/Transport Layer Security
• HTTPS
– HTTP over TLS / HTTP over SSL / HTTP Secure
• Uses public key encryption
– Private key on the server
– Symmetric session key is transferred using
asymmetric encryption
– Security and speed

Answer 4

Web

Question 5

• Security for OSI Layer 3
– Authentication and encryption for every packet
• Confidentiality and integrity/anti-replay
– Encryption and packet signing
• Very standardized
– Common to use multi-vendor implementations
• Two core IPSec protocols
– Authentication Header (AH)
– Encapsulation Security Payload (ESP)

Answer 5

IPSec (Internet Protocol Security)

Question 6

• FTPS
– FTP over SSL (FTP-SSL)
– File Transfer Protocol Secure
– This is not SFTP
• SFTP
– SSH File Transfer Protocol
– Provides file system functionality
– Resuming interrupted transfers, directory listings,
remote file removal

Answer 6

File transfer

Question 7

• Protocol for reading and writing directories over
an IP network
– An organized set of records, like a phone directory
• X.500 specification was written by the International
Telecommunications Union (ITU)
– They know directories!
• DAP ran on the OSI protocol stack
– LDAP is lightweight, and uses TCP/IP
• LDAP is the protocol used to query and update
an X.500 directory
– Used in Windows Active Directory,
Apple OpenDirectory, OpenLDAP, etc.

Answer 7

LDAP (Lightweight Directory Access Protocol)

Question 8

• LDAP (Lightweight Directory Access Protocol)
• LDAPS (LDAP Secure)
– A non-standard implementation of LDAP over SSL
• SASL (Simple Authentication and Security Layer)
– Provides authentication using many different
methods, i.e., Kerberos or client certificate

Answer 8

Directory services

Question 9

• SSH (Secure Shell)
– Encrypted terminal communication
– Replaces Telnet (and FTP)
– Provides secure terminal communication and
file transfer features

Answer 9

Remote access

Question 10

translates human readable domain names (for example, www.amazon.com) to machine readable IP addresses (for example, 192.0.
- port 53 (TCP/UDP)
• DNS had no security in the original design
– Relatively easy to poison a DNS (domain hijacking, url redirection, cache poisoning)
• DNSSEC
– Domain Name System Security Extensions
- used to get around DNS posioning
- (all DNS zones have certificates)
• Validate DNS responses
– Origin authentication
– Data integrity
• Public key cryptography
– DNS records are signed with a trusted third party
– Signed DNS records are published in DNS

Answer 10

Domain name resolution

Question 11

• SSH - Secure Shell
– Encrypted terminal communication
• SNMPv3 - Simple Network
– Management Protocol version 3
– Confidentiality - Encrypted data
– Integrity - No tampering of data
– Authentication - Verifies the source
• HTTPS
– Browser-based management
– Encrypted communication

Answer 11

Routing and switching

Question 12

• Securing DHCP
– DHCP does not include any built-in security
– There is no “secure” version of the DHCP protocol
• Rogue DHCP servers
– In Active Directory, DHCP servers must be authorized
– Some switches can be configured with
“trusted” interfaces
– DHCP distribution is only allowed from
trusted interfaces
– Cisco calls this DHCP Snooping
– DHCP client DoS - Starvation attack
– Use spoofed MAC addresses to exhaust the DHCP pool
– Switches can be configured to limit the number of
MAC addresses per interface
– Disable an interface when multiple MAC addresses
are seen

Answer 12

Network address allocation

Question 13

• Automated subscriptions
– Anti-virus / Anti-malware signature updates
– IPS updates
– Malicious IP address databases / Firewall updates
• Constant updates
– Each subscription uses a different update method
• Check for encryption and integrity checks
– May require an additional public key configuration
– Set up a trust relationship
– Certificates, IP addresses

Answer 13

Subscription services