Implementing Security Protocols Flashcards
Protocols
Act as a common language allowing different components to talk using a common, known set of commands.
Secure Protocols
Those that have built-in security mechanisms, so that by default security can be enforced via the protocol.
DNS
The Domain Name Service is a protocol for the translation of names into IP addresses.
When users enter a name such as www.example.com, the DNS system converts this name into the actual numerical IP address.
DNSSEC
Domain Name System Security Extensions is a set of extensions to the DNS protocol that, through the use of cryptography, enables origin authentication of DNS data, authenticated denial of existence, and data integrity, but does not extend to availability or confidentiality.
SSH
The Secure Shell (SSH) protocol is an encrypted remote terminal connection program used for remote connections to a server.
SSH uses asymmetric encryption but generally requires an independent source of trust with a server, such as manually receiving a server key, to operate.
SSH uses TCP port 22 as its default port.
MIME
Multipurpose Internet Mail Extensions is a standard for transmitting binary data via an e-mail.
E-mails are sent as plaintext files, and any attachments need to be encoded so as to fit the plaintext format, and MIME specifies how this is done with base64 encoding.
Because it is plaintext, there is no security associated with the attachments; they can be seen by any machine between the sender and receiver.
S/MIME
Secure/Multipurpose Internet Mail Extensions is a standard for public-key encryption and signing of MIME data in e-mails.
S/MIME is designed to provide cryptographic protections to e-mails and is built into the majority of modern e-mail software to facilitate interoperability.
SRTP
The Secure Real-time Transport Protocol (SRTP) is a network protocol for securely delivering audio and video over IP networks.
SRTP uses cryptography to provide encryption, message authentication and integrity, and replay protection to the RTP data.
LDAP
Lightweight Directory Access Protocol is the primary protocol for transmitting directory information.
Directory services may provide any organized set of records, often with a hierarchical structure, and are used in a wide variety of situations including Active Directory datasets.
By default, Lightweight Directory Access Protocol (LDAP) traffic is transmitted insecurely.
LDAPS
Lightweight Directory Access Protocol Secure (LDAPS) is LDAP used with SSL/TLS.
LDAPS uses a TLS/SSL tunnel to connect LDAP services. Technically, this method was retired with LDAPv2, and replaced with Simple Authentication and Security Layer (SASL) in LDAPv3. SASL is a standard method of using TLS to secure services across the internet.
LDAPS communication occurs over port TCP 636.
LDAPS communication to a global catalog server occurs over TCP 3269.
When connecting to ports 636 or 3269, SSL/TLS is negotiated before any LDAP traffic is exchanged.
SASL
Simple Authentication and Security Layer
FTPS
The implementation of FTP over an SSL/TLS secured channel. This supports complete FTP compatibility, yet provides the encryption protections enabled by SSL/TLS.
FTPS uses TCP ports 989 and 990.
SFTP
The use of FTP over an SSH channel. This leverages the encryption protections of SSH to secure FTP transfers.
Because of its reliance on SSH, it uses TCP port 22.
SNMPv3
The Simple Network Management Protocol version 3 (SNMPv3) is a standard for managing devices on IP-based networks.
SNMPv3 was developed specifically to address the security concerns and vulnerabilities of SNMPv1 and SNMPv2.
SNMP
Simple Network Management Protocol (SNMP) is an application layer protocol, part of the IP suite of protocols, and can be used to manage and monitor devices, including network devices, computers, and other devices connected to the IP network.
All versions of SNMP require ports 161 and 162 to be open on a firewall.
