What Threat Does It Address? Trust Model Residual Risk

PGP (End-to-End Email Security)

Protects email confidentiality, integrity, authentication, and prevents tampering during transmission. In PGP users trust each other’s public keys through a Web of Trust or verified key exchange. Private keys must remain secret. If private keys are stolen, endpoints are compromised, or users fail to verify public keys, attackers can still read or forge emails. Email metadata (sender, recipient, subject, time) is not encrypted.

SSH (Secure Remote Access)

Prevents eavesdropping, password theft, session hijacking, and man-in-the-middle (MITM) attacks during remote login. In SSH Clients trust the server’s public key (host key). Authentication is typically via passwords or public/private key pairs. Compromised endpoints, stolen SSH keys, weak passwords, or users ignoring host-key warnings can allow unauthorized access.

VPN / IPsec (Network-Layer Tunneling)

Protects data traveling over untrusted networks by encrypting network traffic and authenticating communicating devices. In VPN, Trust is based on VPN gateways, digital certificates, pre-shared keys, or authentication servers. Traffic is protected only inside the VPN tunnel. Compromised VPN servers, endpoint devices, or insider attacks remain risks. VPNs do not protect against malware already on devices.

MACsec (Link-Layer Encryption)

Prevents packet sniffing, tampering, and unauthorized access on local Ethernet networks. Trust relies on authenticated devices using secure keys, usually managed through 802.1X and MKA (MACsec Key Agreement). Protection is limited to a single Ethernet link. Data is exposed after leaving the protected link unless additional encryption is used. Compromised switches or endpoints remain risks.

DNS Security (DNSSEC & DNS Spoofing Protection)

Prevents DNS spoofing, cache poisoning, and forged DNS responses by verifying DNS record authenticity. Trust is based on a hierarchical chain of cryptographic signatures from the DNS root to domain zones. DNSSEC verifies authenticity but does not encrypt DNS queries. Privacy is still exposed, and misconfigured DNSSEC can cause resolution failures.

IDS / IPS (Intrusion Detection & Prevention Systems)

Detects or blocks malicious network activity, attacks, malware, and policy violations. IDS detects; IPS detects and automatically blocks. Trust depends on accurate signatures, behavioral analysis, and correct configuration by administrators. False positives may block legitimate traffic, while false negatives may miss new or sophisticated attacks. Encrypted traffic may limit visibility unless decrypted for inspection.

Configure the fire wall

To check and enable the firewall </>sudo ufw enable

to add rules </>sudo ufw allow 22/tcp

Allow HTTPS if hosting a website: </>sudo ufw allow 443/tcp

block HTTP and my SQL </>sudo ufw deny 80/tcp </>sudo ufw deny 3306/tcp

Final output example </>sudo ufw status verbose