Class 2 - Internet security

Assignments

Type of threat, trust model and residual risk
TLS handshake trace
Port scan and firewall

PGP

protects message content, but trust is user-managed

PGP (Pretty Good Privacy) is a method used to ensure confidentiality and integrity in email communication. It protects against eavesdropping through encryption and prevents tampering by using a digital signature.
PGP operates on a web of trust model, where users validate each other´s public key instead of relying on a central authority. This decentralized approach increases flexibility but also introduces some challenges.
There are several residual risks to consider: key management can be complex for users; email metadata is not encrypted; if private key is compromised, security is lost; and users may make mistakes, such as using the wrong key, and the system may not always verify the fingerprint automatically.

Use case

As an example of a service that natively supports PGP is Proton Mail. I have been using it for a couple of months and have developed confidence in the level of anonymity and security it provides.
Overall, PGP is a powerful tool for secure communication, but it requires careful handling and user awareness to be effective.

SSH

secures remote access, but first connection is risky

SSH provides an encrypted communication channel, protecting against threats such as man-in-the-middle attacks and credential theft. It relies on a “thrust on first use” model: when connecting to server for the first time, you must accept and trust its public key. On subsequent connections, the client verifies that the server’s key matches the original one, ensuring the connection has not been intercepted.
There are some important risks to consider: the first connection is vulnerable to MITM attack if the server is not verified, if a private key is stolen this will led to unauthorized access, and if the server itself is compromised the attacker can gain access to communication and credentials.

Use case

As part of this course, SSH can be used to connect to the class virtual server. I downloaded and configurated WireGuard and attempted to establish the connection. However, I was not able to connect successfully.
At this point, I don’t know whether is due to network restrictions or configuration error on my side.
As expected, I switched the ISP for the machine I’m using (by sharing the connection from my phone), and I was able to successfully establish connection to the cyberclass VM. Now, the fun part begins.

VPN

secures network paths, but endpoint must be trusted

A VPN (Virtual Private Network) provides secure network tunneling, helping protect against risks such as IP spoofing and data tampering during transmission. It creates an encrypted channel between the user and the VPN server, ensuring that the data traveling across the network is protected.
Most VPN´s operate on a centralized trust model, meaning that the VPN provider must be trusted. Authentication is typically handled using certificates or shared keys. There are several risks to consider: VPN providers can see your traffic; if an endpoint is compromised, the protection is lost; and VPN only secure data within the tunnel and do not protect activity outside of it.

Use case

In this course, we use WireGuard to connect to he same network as the cyberclass virtual machine. This allows us to securely access the environment and establish an SSH connection to the machine, where all the required tools are installed.

MACsec

secure local links, not full paths

MACsec, also known as IEEE 802.1AE, is a network security standard designed to encrypt and authenticate Ethernet traffic between directly connected devices. It helps protect against threats such as LAN sniffing, data tampering and unauthorized devices on a local network.
MACsec operates using a mutual authentication model, typically based on pre-shared key, where both devices verify each other before establish a secure connection.
There are some limitations to consider, such as: MACsec only protects a single network link, not end-to-end protection; this leads to a limited deployment; and if devices are compromised the network will bypass it, MACsec won´t see anything suspicious.
This type of encryption is an effective solution for securing local Ethernet connections, but it must be combined with other security measures in order to achieve a high network protection.

DNS security

ensures DNS integrity, not confidentiality

DNS security refers to a set of technologies and practices designed to protect DNS infrastructure from cyberattacks, ensuring the accurate translation of domain names into IP addresses. Since the original DNS protocol was not designed with security in mind, these measures are essential to prevent issues such as traffic redirection to malicious sites, data interception and service disruption.
DNS security mechanisms typically rely on a chain of trust model, where each level of the DNS hierarchy validates the next. This approach helps ensure the authenticity and integrity of DNS responses.
However, there are still some residual risks to consider: human behavior, such as misconfigurations; phishing vulnerability; and potential compromise of DNS zone keys, undermining the trust chain.
DNS security significantly improves the reliability and safety of internet navigation, but it must be properly implemented to be effective.

IDS / IPS

detects / blocks attacks, but not perfectly

An IDS (Intrusion Detection System) is designed to monitor network or system activity and detect suspicious behavior. When potential threats are identified, the system generates alerts for future investigation. IDS typically relies on monitoring and rule-based detection models.
IDS can have limitations such as false positive (legitimate traffic flagged as suspicious), false negative (malicious traffic going undetected), does not actively stops attacks and requires human intervention to respond to detected threads.
An IPS (Intrusion Prevention System) builds upon IDS capabilities + actively blocks attacks in real time. IPS relies on automated decision making and proper configuration to function effectively. The associated risks include: false positive can block legitimate traffic; attackers can evade detection mechanisms; and misconfiguration can leave to significant disruptions.

TLS handshake

Port scan and firewall

I installed nmap on the VM and reviewed it’s documentation before running a scan sudo apt install nmap man nmap. I performed a rapid scan using SYN scanning along with service and version detection sudo nmap -T4 -sS -sV localhost. The results showed three open ports: SSH (expected), IPP and VNC (also expected).
Since I wasn’t familiar with port 631, I looked it up and found that it is commonly used for network printing. This service can pose a security risky if exposed withouth proper restrictions.
Next I checked the firewall status using UFW (uncomplicated firewall) and found that is was disabled sudo ufw status. I first allowed SSH access sudo ufw allow ssh and then enabled UFW sudo ufw enable. After enabling it, I verified the rules and saw that traffic was allowed on ports 22 and 5901.
At this point, I denied access to the VNC 5901 port sudo ufw deny 5901, ensuring that only SSH access remained explicitly allowed. Forgot about the 631 port, but will be implicitly blocked by the firewall by default.