Security Standards: Firewall, Cryptography

Notes

Study Notes

Security Standards and Core Technologies

Core Security Standards and Enforcement Technologies

Technologies and best practices that form the backbone of modern digital security architecture.

1. Firewall

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between a trusted internal network and untrusted external networks (like the Internet).

Types and Functionality:

  • Packet-Filtering Firewall: Examines the source and destination IP addresses and port numbers of packets. Simple and fast, but lacks deep context.
  • Stateful Inspection Firewall: Keeps track of the state of active connections, allowing it to determine if a packet belongs to an existing session, offering much better security than simple packet filters.
  • Application Layer Firewall (Proxy Firewall): Filters traffic at the application layer, scrutinizing the contents of the message (e.g., HTTP requests) and protocols, offering the highest level of inspection.

2. Cryptography

Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behavior. It primarily ensures **confidentiality** and **integrity** of data.

[Image of the process of encrypting plaintext into ciphertext and decrypting it]

Key Cryptographic Methods:

  • Symmetric-Key Cryptography (e.g., AES): Uses a single secret key for both encryption and decryption. It is fast and efficient, primarily used for encrypting large amounts of data.
  • Asymmetric-Key Cryptography (PKI, e.g., RSA, ECC): Uses a pair of mathematically linked keys: a public key for encryption and a private key for decryption (or vice-versa for signing). Used for secure key exchange, digital signatures, and establishing secure sessions (TLS/SSL).
  • Hashing Functions (e.g., SHA-256): One-way functions that convert data into a fixed-length string (a message digest). Used to verify data integrity and securely store passwords.

3. Key Management

Key management refers to the set of policies, procedures, and systems used to govern the lifecycle of cryptographic keys, from generation and distribution to storage, rotation, and destruction. Proper key management is paramount for the effectiveness of all cryptographic controls.

Lifecycle and Security Requirements:

  • Generation: Keys must be generated using cryptographically strong random processes.
  • Storage: Private keys must be stored securely, often in a Hardware Security Module (HSM) or a Key Management System (KMS), protected by strong access controls.
  • Rotation (Re-Keying): Keys should be regularly replaced to limit the amount of data encrypted under one key, minimizing the impact if a key is compromised.
  • Revocation/Destruction: Procedures to retire and securely destroy keys once they are no longer in use or have been compromised.

4. Password Systems

Password systems encompass the mechanisms and policies used to authenticate users based on something they know (the password). Security standards focus on both user behavior and backend storage.

Standards for Secure Implementation:

  • Secure Storage (Salting & Hashing): Passwords must never be stored in plaintext. They are stored as cryptographic hashes combined with a unique, random string called a **salt**. This prevents rainbow table attacks and ensures that two users with the same password have different stored hashes.
  • Adaptive Hashing Algorithms: Use computationally intensive, slow hashing functions like **Bcrypt** or **Argon2** instead of fast functions like SHA-256 for password storage, making brute-force attacks impractical.
  • Multi-Factor Authentication (MFA): Mandating the use of two or more verification factors (something you know, something you have, something you are) greatly reduces the risk of password compromise.
  • Input Controls: Implementing strong minimum length requirements (e.g., 12+ characters), complexity checks, and rate limiting login attempts to prevent brute-force attacks.

5. Digital Certificates and PKI

A digital certificate is an electronic document used to prove ownership of a public key. It is the cornerstone of Public Key Infrastructure (PKI), enabling secure communication channels like HTTPS.

Core Components:

  • Certificate Authority (CA): A trusted third party (e.g., Let's Encrypt, DigiCert) that verifies the identity of the certificate requester and signs the certificate.
  • X.509 Standard: The most common format for digital certificates, defining fields like the owner's public key, the owner's identity, the CA's signature, and the certificate's validity period.
  • TLS/SSL Handshake: Digital certificates are used during this process to authenticate the server to the client (browser) and facilitate the secure exchange of the symmetric key used for the session.

6. Digital Signatures

Digital signatures are a cryptographic technique used to validate the **authenticity** (who signed it) and **integrity** (that it hasn't been changed) of digital information. They are the digital equivalent of a wet ink signature.

Process Summary:

  • Creation: The sender hashes the document to create a message digest, then encrypts that digest using their **private key**. This encrypted hash is the signature.
  • Verification: The receiver decrypts the signature using the sender's **public key** to retrieve the original digest. They independently hash the document themselves. If the two digests match, the signature is valid.
  • Guarantees: Provides non-repudiation, ensuring the signer cannot deny having signed the document.

These standards work in concert—firewalls protect the perimeter, cryptography secures the data, and key management ensures the cryptographic processes remain sound and trustworthy.

Navigation

E Security: Sec... Back to Module
Module Complete