Class 2 Internet Security Threat Addresses

1. PGP (Pretty Good Privacy) – End-to-End Email Security Protects against eavesdropping by intermediate email servers, ISPs, or malicious network actors. It stops tampering with the message body during transit. It prevents identity spoofing by ensuring that a message signed by a specific private key must have originated from that sender.

2. SSH (Secure Shell) – Secure Remote Access Eradicates cleartext credential sniffing over public or untrusted networks - replacing vulnerable protocols like Telnet. It stops Man-in-the-Middle (MitM) session hijacking through cryptographic host verification. It blocks unauthorized administrative access via brute-force password guessing when public-key authentication is enforced.

3. VPN / IPsec – Network-Layer Tunneling Counteracts network wiretapping and traffic analysis across third-party transport infrastructure like the public internet. It prevents unauthorized entry into private enterprise networks by authenticating boundary endpoints. It blocks packet injection and routing modification by cryptographically sealing the entire IP packet header and payload.

4. MACsec (802.1AE) – Link-Layer Encryption Neutralises physical layer attacks such as passive fiber tapping and physical hardware interception between directly connected switches. It blocks layer-2 rogue device injection, ARP poisoning, and DHCP spoofing by validating the cryptographic signature of every incoming Ethernet frame at the hardware level.

5. DNS Security (DNSSEC) – Authoritative Name Resolution It eliminates DNS cache poisoning and spoofing where attackers insert fraudulent records into recursive name servers to redirect users to phishing sites. It halts Man-in-the-Middle payload alteration of active DNS responses by validating the cryptographic signatures of incoming data packets.

6. IDS / IPS – Network Detection vs. Prevention It identifies known malware traffic patterns, network scanning, exploit attempts, and unusual behavioral anomalies. The IDS addresses the threat of undetected data breaches by alerting analysts to ongoing compromises. The IPS active inline tool addresses active threats by directly dropping offending packets to prevent immediate network exploitation.

Trust Model

1. PGP (Pretty Good Privacy) – End-to-End Email Security Decentralized Web of Trust (WoT). Users explicitly sign each other’s public keys to validate identities instead of relying on a centralized Certificate Authority (CA). Endpoints must fully trust that the local hardware hosting the keys is secure and uncompromised.

2. SSH (Secure Shell) – Secure Remote Access Trust on First Use (TOFU). During the initial connection, the client saves the server’s unique public host key fingerprint. Subsequent logins assume the identity is stable unless that fingerprint changes. It requires absolute trust in the client device not to expose stored private keys.

3. VPN / IPsec – Network-Layer Tunneling Centralized, peer-to-peer pre-shared keys (PSKs) or an enterprise Public Key Infrastructure (PKI) using X.509 certificates. Both tunnel endpoints must mutually trust a central authority (or an identical shared secret string) to authenticate each other before building the secure channel.

4. MACsec (802.1AE) – Link-Layer Encryption Localized point-to-point hop authentication. It utilizes standard protocols like 802.1X or static Connectivity Association Keys (CAK) directly configured between adjoining network interfaces. Each switch hardware chip trusts its immediate neighbor interface explicitly without requiring end-to-end logical validation.

5. DNS Security (DNSSEC) – Authoritative Name Resolution A centralized, hierarchical Chain of Trust rooted at the ICANN DNS root zone. Each domain registry digitally signs its sub-delegated zones. To trust a lower-level record, a resolver must verify every linking signature all the way back up to the public root anchors.

6. IDS / IPS – Network Detection vs. Prevention Knowledge-based and heuristic trust. The system relies entirely on the accuracy and freshness of threat intelligence rule feeds, vulnerability signatures, and baseline metrics curated by internal security teams or external security vendors. It operates on the assumption that anything matching a known bad pattern must be blocked or logged.

Residual Risks

1. PGP (Pretty Good Privacy) – End-to-End Email Security Metadata remains completely exposed (the sender, recipient, subject line, and timestamp are visible to transit nodes). Malleability attacks can inject malicious HTML code to exfiltrate decrypted text if the email client is insecure. Key revocation is notoriously difficult to propagate through the decentralized network.

2. SSH (Secure Shell) – Secure Remote Access Malicious actors can deploy a MitM exploit during the very first connection before the fingerprint is established. Malware on a client machine can steal active SSH agent sockets to pivot laterally into servers. Misconfigured servers may continue to support weak, legacy encryption ciphers vulnerable to modern compute clusters.

3. VPN / IPsec – Network-Layer Tunneling Compromise of a single gateway private key can allow an attacker to decrypt captured historic session traffic if Perfect Forward Secrecy (PFS) is disabled. Once an attacker establishes an authorized endpoint connection, they can launch lateral attacks across the internal subnet. Software flaws in the IPsec processing stack can leak internal gateway network data.

4. MACsec (802.1AE) – Link-Layer Encryption Security guarantees terminate instantly inside the switch memory; data is fully decrypted to plaintext within the device before being re-encrypted for the next hop. Hardware performance degradation can occur if line-rate cryptographic engines fail. Misconfigured fall-back policies might default to cleartext transmission if an adjacent port fails to negotiate a secure link

5. DNS Security (DNSSEC) – Authoritative Name Resolution DNSSEC does not provide any data privacy or encryption; domain lookup requests and responses remain entirely visible to network sniffers unless paired with separate protocols like DoH or DoT. It is highly susceptible to Denial of Service (DoS) amplification attacks because cryptographically signed DNS responses are vastly larger than standard plain UDP answers.

6. IDS / IPS – Network Detection vs. Prevention Encrypted network traffic (like TLS 1.3) blinds the inspection engines completely unless intrusive, compute-heavy decryption proxies are deployed. Advanced attackers use obfuscation, fragmentation, and zero-day exploits to bypass static signatures. An IPS introduces the critical operational risk of false positives, which can accidentally block legitimate business-critical network traffic and disrupt service availability.