Course information
This course is part of a security specialization offered by the department which consists of four courses:
Computer security, Network security, Language-based security and Cryptography.
We begin the course by looking at weaknesses that have plagued networked systems for years. We then continue with countermeasures like firewalls and security protocols such as SSL/TLS, SSH and IPsec and investigate in detail what makes them secure. The course also gives a survey of cryptographic tools and explains how they can be utilized in protocols and applications, for example how to provide secure user authentication over a public network.
Knowledge about possible threats and countermeasures is important not only for the network security specialist but also for application programmers and everyone else who wants to understand what level of security a system and an application can offer. By knowing the problems, future systems can be designed to be much more secure and reliable than today.
This course covers the underlying principles and techniques for network and communication security. Practical examples of security problems and principles for countermeasures are given. The course also surveys cryptographic and other tools used to provide security and reviews how these tools are utilized in protocols and applications.
Prerequisites for this course are good knowledge of communication principles and protocols (TCP, IP, ICMP, ARP, etc.). You must have taken at least one communications course before this course. We also recommend that you have taken the course Computer Security which shows how to think regarding security and discusses security issues in a wider perspective. Other relevant courses are Computer Networks and Cryptography which will make some topics easier to understand.
The course consists of a series of lectures and laborative exercises. The laborative exercises focus on network scanning, building firewalls, configuration of an intrusion detection system (IDS) and practical work with analyzing the SSL/TLS protocol. The course ends with a written exam. To pass the course, the exam must be passed and all laborative exercises must be completed.
Reading material
The course consists of the following material:
- Text book including web chapters (see lecture plan for details)
- Mandatory reading material listed below
- Material presented at lectures such as slides
- Reading related to the lab work
Text book
William Stallings: Cryptography and Network Security, seventh edition ISBN 978-1-292-15858-7 or sixth edition ISBN 978-0-273-79335-9. The difference is that in the latest edition chapter 17.3 about TLS does not exist but has been integrated with the rest of the text in chapter 17.This book is shared with the Cryptography course. The book is to a large extent followed during the lectures, but some topics are missing or not deep enough so additional material is used in some lectures, see reading list below.
The book has a companion web page with student resources and useful links if you want to know more about a subject. There is an errata sheet for the book that you may want to check, and the book also has online chapters that are used in the course. You need the code printed in your book to access them.
It is also possible to use the book Network Security Essentials, also by William Stallings. It contains the same chapters but the cryptography part is omitted. Although it is almost half the size, the price is almost the same as for the full book. The book is also available as an e-book, ISBN 978-0-273-79376-2.
Mandatory reading
The course book lacks information about certain topics. The following papers are therefore an integral part of the course and will be part of the exam. Some links go to research papers published by IEEE and ACM and can only be downloaded from the Chalmers network. These papers describe interesting and important security aspects and will also introduce you to research papers in the area, and reading such papers will be important for you in your future career. Please not that the list will be updated during the course. Information about future, upcoming, lectures is preliminary and may change.
- Introduction: CAPEC - Mitre's web page with different categories/mechanisms of attacks. Look at the different mechanisms (open them) and study the types of attacks that they have identified. Many of them will be further investigated in the course. This is a very good summary of different problems we are up against!
Also look at sectools.org where they list the top 125 network security tools. Many of them will be discussed in the course.
- User Authentication: Authentication: Joshua Hill, Bugtraq mailing list, 12 November 2001: An Analysis of the RADIUS Authentication Protocol (ignore 4.2 about protocol improvements). It is a very old paper but still relevant. Read it to see how a protocol is analyzed - it is the methodology that is important although Radius is a widely used protocol.
- Network layer security (IP): Security assessment of the IP protocol, RFC 6274, which is created from a paper published by Centre of Protection of National Infrastructure CPNI in the U.K (a slightly older original with nicer formatting is available here). It is the general understanding that is important and what types of vulnerabilities there are, not the exact details about number of bytes, etc.You can skip chapter 3.13 (options), 3.14 (DiffServ) and 3.15 (ECN) - the last two are only available in the CPNI PDF document.
- Transport layer security (TCP): Security assessment of the TCP Protocol from CPNI and now an Internet draft (work in progress). The original with nicer formatting can be downloaded from here (read only chapter 5 to 8, 12 and 14). IETF have also published slides summarizing the RFC (voluntary reading).
- Firewalls: NAT router security solutions, tips and tricks. A nice web page explaining what security we can expect to get from using a NAT router/gateway as a firewall.
- WLANs: The final nail in WEP's coffin (good overview of WEP insecurity and how to analyze a protocol). Copyrighted, only accessible from Chalmers network.
- Link layer security: Kiravuo, et.al: A Survey of Ethernet LAN Security, IEEE Communication Surveys & Tutorials, Vol 15, No. 3, 2013.
- A report from Symantec summarizing many of the security problems we have seen in this course: A security analysis of Windows Vista's network implementation. Read page 1-11, 16-22, 24-25 and page 28. This paper is a good test that you have understood many of the topics discussed in the course. Although Windows Vista is old, the same protocol stack is used in Windows 10 and it shows the types of mistakes people do when they implement protocols.
Voluntary reading - if you want to know more about a topic
The reading list below provides more information about some topics for the interested. You don't need to study it for the exam. Some papers may explain things presented at lectures in a different way, something that may be useful for your understanding. And some other topics are just additional reading for the interested. Square bullets are used for published research articles in the field:
Authentication:
- Interesting web page about how we select 4-digit PIN codes - What numbers are most common? Or least common?
- IBM Research: Remote Client Authentication, IEEE 2008. A summary of different ways to remotely authenticate users and systems. (Can only be downloaded from the Chalmers network.)
Cryptography:
- An Overview of Cryptography by Gary Kessler - contains many of the topics used in this course.
- What is steganography and how does it differ from cryptography? It looks at the differences between cryptography and steganography but also how the two fit together.
- Nigel Smart at University of Bristol has published a free book about cryptography and the latest edition can be downloaded freely. It covers all from historical to current ciphers (PostScript format).
- From Stanford magazine Nov 7, 2014: About the politics surrounding cryptography research. Describes the problems Standford researchers Diffie and Hellman had when releasing their original work.
- CISCO has published a similar paper about next-generation cryptography (NGC)
- Papers about hash functions and when they discovered collisions: MD5 collision demo, Authenticode and MD5 collisions and RFC 6151 about MD5 and HMAC_MD5 security.
- A nice story about how a 250 year old cipher was cracked partly using human language translation tools. From Wired Magazine Dec 2012. The beginning may seem boring, but it soon becomes more interesting.
- The problem with too many trusted SSL certificates in web browsers (by the EFF foundation)
Tools:
- Cyber Scanning: A Comprehensive Survey - an overview of different scanning techniques (easy and rather long). From fall 2014.
Weaknesses:
- TCP: Security Problems in the TCP/IP Protocol Suite an early and famous paper from 1989 written by Steven Bellovin at Bell Labs.
- TCP: Protection against SYN flood attacks by Cisco - a nice overview of different techniques
- TCP: More info about TCP initial sequence numbers and pictures from other operating systems:
http://lcamtuf.coredump.cx/oldtcp/tcpseq.html and a follow up at http://lcamtuf.coredump.cx/newtcp
- ICMP attacks against TCP: RFC 5297 discusses security in ICMP and how it can affect protocols such as TCP.
- DDoS: Flawed Routers Flood University of Wisconsin Internet Time Server
- DDoS: How Kaspersky Lab Disabled the Hlux/Kelihos Botnet (Sept., 2011)
Firewalls:
- Windows 10 Firewall configuration and design: (a Microsoft Technet article). Describes how to configure the Windows firewall and what features it has.
SSL/TLS, SSH:
- A 45 minute video from Defcon 16 demonstrating a major bug in the pseudo-random number generator (PRNG) in the Debian OpenSSL package affecting SSL/TLS, SSH, and many other applications relying on good random numbers. They explain why it happened and how it affects security.
- SSL/TLS Strong Encryption: An Introduction. From the Apache documentation (world's most widely used web server). Summarizes many things like certificates, the protocol, etc.
- Understanding SSH port forwarding (easy and short reading explaining how port forwarding works)
- Pitfalls when implementing SSL in non-browser applications. Good reading if you want to implement SSL/TLS in your own application and is serious about it.
- The SSL POODLE attack problem
IPsec:
-
- An IPsec video, sligthly old, but still valuable describing security in IPsec
- IPv6 Security written for SURFnet
- A Cryptographic Evaluation of IPsec by Bruce Schneier 2003. It is interesting reading, and some proposed changes such as abandoning the AH protocol was later done!
- How NAT-T works with IPsec - A Cisco document describing how IPsec can be compatible with NAT
WLAN:
- Top 5 myths about wireless protection: (in)secure magazine #22 (sept 09), page 55-58. It is still valid...
Link-level security, DNSsec, etc.:
- Practical Switch Security - describes how switches can be configured to enhance security (link may be broken)
- A Framework for DNSsec Policies and DNSsec Practice Statements (RFC 4861)
Remote access:
- Improved Port Knocking with Strong Authentication - a paper that describes port knocking and how authentication can be done (early paper, 2005).
Security, general:
- The Secret Life of SIM cards. A YouTube video about smart cards and SIM cards and how to program them.
- A good article from The Guardian, Sept 2013: NSA surveillance: A guide to staying secure
- More comments from Bruce Schneier about the NSAs cryptographic capabilities
- The latest Symantec Internet Security Threat report
News announcements and security magazines. These resources can be useful for you in the future:
- SANS Security Reading Room - a site with lots of reading material about security
- Kaspersky labs and their Threat Post news service
- SC Magazine have lots of news about security related issues. It is not always that deep, though...
- (In)secure magazine - news about all kinds of security, hacking, tools, etc.
- Swedish CERT.se with the possibility to subscribe to weekly security news (in Swedish only)
Lectures
Lectures will be held:
- Tuesdays 13:15 - 15:00, HC3
- Thursdays 13:15 - 15:00, HC3
- Fridays 13:15 - 15:00, HC3
Not all lecture times will be used, please see the schedule below for exact details.
The table also shows what will be covered during each lecture and will be continuously updated during the course. There will most likely be some day and topic changes so please check the table regularly. Links to slides are placed in this table.
Slides from the lectures will be available for download before the lecture, but please note that minor changes should be expected in the final version placed here shortly after each lecture (fixed typos, etc.)