Secret Key Cryptography

• The sender applies a key to encrypt a message
• The receiver applies the same key to decrypt the message
• Only single key is used - symmetric encryption
• The biggest problem with symmetric encryption is distribution of the key

Public Key Cryptography

• Each party has a private key and a public key
• The private is secret and is not revealed while the public key is shared with all those whom you want to communicate with
  • Asymmetric encryption

Certificates

• Digitally signed documents
• Verifies the validity of the public key
• The user's guarantee that:
  • the public key really belongs to the sender
  • the transmitter holds the private key
• What can be done with the public key

Certificates

• What does a certificate contain?
  • Serial Number
  • Subject
  • Signature Algorithm
  • Signature
  • Issuer
  • Validity period
  • Key-Usage
  • Public Key
  • Thumbprint Algorithm
  • Thumbprint (also known as fingerprint)

Certificates - Web Servers

1. Client connect on port 443, requests the server identity
2. Server sends a copy of the TLS Certificate, including servers public key
3. Client check against list of thrusted CA´s and that the certificate is valid. Creates a symmetric key, encrypt it with the public key from the server.
4. Server decrypt the symmetric key with its own private key. Start using the symmetric key when encrypt the messages
5. We have a trusted and encrypted communication

Public-Key Infrastructure (PKI)

• Anyone can send a secret message
  • Provided they know the public key
• How do we know a key belongs to a certain issuer?
• One solution: PKI - Public Key Infrastructure
  • Trusted root authority - Certificate Authority (CA) (VeriSign, GlobalSign)
    • Everyone must know the verification key of root authority
    • Root authority can sign certificates
  • Certificates identify others, including other authorities
  • Leads to certificate chains

By Yanpas (Own work) CC BY-SA 4.0

Perform SSH Login Without Password

1. Create public and private keys using ssh-key-gen on localhost

   ssh-keygen
   Generating public/private rsa key pair.
   Enter file in which to save the key (/home/ubuntu/.ssh/id_rsa):
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /home/ubuntu/.ssh/id_rsa.
   Your public key has been saved in /home/ubuntu/.ssh/id_rsa.pub.
   

2. Copy the public key to remote-host using ssh-copy-id

   ssh-copy-id -i ~/.ssh/id_rsa.pub user@remot-ip
   

3. Login to remote-host without entering the password

   ssh user@remot-ip
   or
   ssh -i ~/.ssh/id_rsa.pub user@remot-ip
   

Firewall

Ring 1 - Internet Edge

• The first attack point
  • Being exposed to attacks from outside
• Common mistakes
  • Many places the most intelligent and powerful firewall
  • Most attacks occur from inside the network
• Speed is crucial
  • Usually a high performance hardware firewall

Firewall

Ring 2 - Backbone Edge

• Between the internal network and the Internet Edge
• Backbone networks are providing a common network that all network segments are connected to
• Total volume of traffic flowing in and out through the backbone Firewall is smaller than that of the Internet edge firewall
• Begins the real firewall work through dynamic application layer filtering of both inbound and outbound traffic

Firewall

Ring 3 - Asset network edge

• Packet filtering is insufficient
• Not only examine all incoming traffic with profound dynamic packet filtering, but also examine the output of user/group control
• User/group control is an absolute requirement:
  • You must be able to log the user name for all outgoing
  • You must be able to log an application
  • Your organization may be held responsible for material that leaves the network

Firewall - Ring 4 - LocalHost security

• Computer-based security is the last defense.
  • UFW (default firewall in Ubuntu) - https://help.ubuntu.com/community/UFW
• No firewall can completely offset the weaknesses that exist on your computer
  • The only thing that can prevent attacks from the local network
  • Check the inbound/outbound connections that can be made and which applications can send and receive data
• Operating systems and applications must be kept updated
  • Servers - do one thing only
• Users and services should be run with minimal permissions

Firewall

Smaller networks

• Simple networks does not need all rings
• Public services should be located in the DMZ segment between the Internet edge and Asset edge
• The simplest networks only need to place a single firewall at the Internet edge
  • Do not forget about localhost security
    • Take passwords serious!!! Always!

Demilitarized Zone (DMZ)

• A network that is placed as a neutral zone between a corporate network and the Internet
• Prevents outside users from getting direct access to the internal corporate network
• Includes the company's external/public resources:
  • Web servers
  • Public Name servers
  • E-mail
  • FTP
• If a DMZ is penetrated the attacker won't get access to information on the internal network