1. COEN 350 Network Security Introduction

2. Computer Networks OSI Reference Model Application Layer Presentation Layer Session Layer Transport Layer Network Layer Data Link Layer Physical Layer

3. OSI Reference Model Useful to establish terminology Not implemented Upper layer implemented in terms of lower layer.

4. OSI Reference Model Application Layer Locus of applications that use networking P2P HTTP ftp Presentation Layer Encodes application data into a canonical form Decodes it into system-dependent format at the receiving end.

5. OSI Reference Model Session Layer Extra functions over reliable one-to-one connection RPC Transport Layer Reliable communication stream between a pair of systems. IP, UDP, TCP, ICMP

6. OSI Reference Model Network Layer Computes paths across an interconnected mesh of links and packet switches Forwards packets over multiple links from source to destination

7. OSI Reference Model Data Link Layer Organizes physical layer’s bits into packets and controls who on a shared link gets each packet. Physical Layer Delivers an unstructured stream of bits across a single link of some sort.

8. TCP/IP Suite

9. Protocol Layers and Security Security measures often layer network protocols. Protect contents of packages is protection at layer 2. Still allows traffic analysis. IPSec protects (encrypts) packages at layer 4 Does not work with NAT.

10. Goals Authentication Who are you? Authorization Are you allowed to do that? Integrity Is this the real message? Privacy Does anyone else know about it?

11. Zone of Control The zone that needs to be secured in order to prevent eavesdropping. Physical access needs to be prevented. Tempest program (US military)

12. Legal Issues Patent Law First inventor has the right to invention. Patents issued based on what inventors present regarding Novelty (  Prior Art) Importance (“Aha” effect) Patent process flawed since Reagan underfunding, but slowly getting better Many cryptography algorithms are moving into the public domain.

13. Legal Issues Export Control Cryptographic algorithms and tools were considered to be restricted technology. Treated like ammunition. Taking a laptop to Mexico for a week-end could be a violation of export control. Government gave up after PGP fiasco

14. Legal Issues Key Escrow Cryptography algorithms became unbreakable in the nineties. Prevent wiretaps, computer forensics, etc. National security efforts sponsored Clipper: Encryption chip Two different agencies needed to cooperate to recover secret key. Government gave up.