Internet Security¶
For each of the following systems, research and document 3 parts what threat does it address? what’s the trust model? what’s the residual risk?
| System | Threat Addressed | Trust Model | Residual Risk |
|---|---|---|---|
| PGP (Pretty Good Privacy) (End-to-End Email Security) | Protects emails from being read or changed by unauthorized people. | Users trust each other’s public keys. The sender encrypts using the recipient’s public key, and only the recipient’s private key can decrypt it. | If private keys are stolen, passwords are weak, or users verify the wrong public key, attackers can still access emails. |
| SSH (Secure Shell) (Secure Remote Access) | Protects against hackers spying on or changing data while remotely accessing a computer. | The client trusts the server’s public key, and the server verifies the user’s password or SSH key. | Stolen SSH keys, weak passwords, or users accepting fake server keys can allow unauthorized access. |
| VPN / IPsec (Network-Layer Tunneling) | Protects data sent over public networks (such as the Internet) from eavesdropping and tampering. | Devices trust each other using digital certificates or shared secret keys before creating an encrypted tunnel. | If an endpoint device is infected with malware or credentials are stolen, encrypted communication can still be compromised. |
| MACsec (Media Access Control Security) (Link-Layer Encryption) | Prevents attackers on the same local network from listening to or changing network traffic. | Network devices (switches and computers) authenticate each other before encrypting traffic. | It only protects traffic on a single network link. Data may not be protected after it leaves that link. |
| DNS Security (DNSSEC & DNS Spoofing) | Prevents attackers from redirecting users to fake websites by altering DNS responses. | Users trust DNS records that are digitally signed by the domain owner and verified through a chain of trust. | DNSSEC verifies authenticity but does not encrypt DNS traffic. If DNS is not configured correctly, attacks may still succeed. |
| IDS / IPS (Intrusion Detection & Prevention Systems) | Detects or blocks cyberattacks such as malware, hacking attempts, or unusual network activity. | Organizations trust the IDS/IPS to recognize known attack patterns and suspicious behavior. | New or unknown attacks may not be detected. False alarms or missed attacks are also possible. |
Simple Summary¶
PGP → Keeps emails private. SSH → Securely logs into remote computers. VPN/IPsec → Creates a secure tunnel over the Internet. MACsec → Encrypts data traveling across a local network cable. DNSSEC → Ensures website addresses are genuine and not redirected. IDS/IPS → Monitors network traffic for attacks; IDS alerts, while IPS can automatically block threats.
Remember:
Threat addressed = What problem it solves. Trust model = Who or what must be trusted for it to work securely. Residual risk = The risks that still remain even after using the security system.
TLS Handshake Trace¶
Exercise 1: TLS Handshake Trace What is a TLS Handshake?
A TLS handshake is the process that creates a secure connection between your computer and a website before any information is sent.
How it works¶
- The client (your computer) requests a secure connection.
- The server sends its certificate to prove its identity.
- The client and server agree on:
- TLS version: TLS 1.3
- Cipher suite: TLS_AES_256_GCM_SHA384
- Key exchange: ECDHE
- They create a shared secret key.
- All data is encrypted and sent securely.
What can an observer see?¶
- IP addresses
- Port number (443)
- TLS version
- Cipher suite
- Server certificate
What can’t an observer see?¶
- Passwords
- Messages
- Website content
- Files being transferred
Exercise 2: Port Scan & Firewall¶
What is a Port Scan?
A port scan checks which network services on a computer are open and reachable.
Example scan result:
| Port | Service | Status |
|---|---|---|
| 22 | SSH | Open |
| 80 | HTTP | Open |
| 443 | HTTPS | Open |
What does the firewall do?¶
A firewall blocks unwanted network traffic and only allows approved services.
Example firewall settings:
Allow SSH (22) for remote login. Allow HTTPS (443) for secure web access. Block HTTP (80) to improve security.
Result after firewall configuration¶
| Port | Status |
|---|---|
| 22 | Open |
| 80 | Blocked |
| 443 | Open |
Conclusion¶
The TLS handshake creates a secure, encrypted connection between a client and a server. The server proves its identity using a certificate, and both sides agree on a cipher suite and key exchange before encrypting data. A port scan shows which services are accessible from the network. A firewall improves security by blocking unnecessary ports while allowing only the services that are needed.
Virtual Machine (VM) as a house connected to the Internet.¶
What is a Port?
A port is like a door to your house. Different services use different doors.
For example: Port 22 → SSH (remote login) Port 80 → HTTP (website) Port 443 → HTTPS (secure website)
If a door is open, people can try to enter through it.
What is a Port Scan?¶
A port scan is when someone checks your computer to see which doors (ports) are open.
For example, using Nmap: nmap 192.168.1.10
### Output:
| PORT | STATE | SERVICE |
|---|---|---|
| 22/tcp | open | ssh |
| 80/tcp | open | http |
| 443/tcp | open | https |
This tells us:
| Port | Service | Meaning |
|---|---|---|
| 22 | SSH | Remote login is available. |
| 80 | HTTP | A web server is running. |
| 443 | HTTPS | A secure web server is running. |
So, the scan reveals what services your VM is exposing to other computers.
What is an Exposed Service?¶
An exposed service is any program on your VM that people on the network can reach.
For example:
- SSH lets someone log in remotely.
- HTTP lets people visit your website.
- HTTPS lets people access your secure website.
The more exposed services you have, the more chances attackers have to find weaknesses.
What is a Firewall?¶
A firewall is like a security guard standing at every door of your house.
It decides:
✅ Allow trusted traffic.
❌ Block unwanted traffic.
Example: Before firewall:
Internet
│
▼
22 (Open)
80 (Open)
443 (Open)
Now attackers cannot reach Port 80.
How do you configure the firewall?¶
On Ubuntu, use UFW (Uncomplicated Firewall).
Enable the firewall:
</> Bash
sudo ufw enable
Allow SSH:
</> Bash
sudo ufw allow 22
Allow HTTPS:
</> Bash
sudo ufw allow 443
Block HTTP:
</> Bash
sudo ufw deny 80
Check the firewall status:
</> Bash
sudo ufw status
Example output:
| 22/tcp | ALLOW |
| 80/tcp | DENY |
| 443/tcp | ALLOW |
Why do this?¶
Suppose your VM only needs SSH for remote login.
If Ports 80 and 443 are not needed, leaving them open gives attackers extra ways to try to access your VM.
By blocking unused ports, you reduce the number of “doors” an attacker can try.
Simple Explanation for Your Assignment¶
Port Scan: A port scan checks which ports on the VM are open and what services are running.
What it reveals: It shows the services that other computers can access, such as SSH (22), HTTP (80), or HTTPS (443).
Firewall: A firewall controls which ports are open or blocked. After configuring it, only the necessary services remain accessible, making the VM more secure by reducing what can be reached from outside.