Thursday, November 14, 2013

Transport Layer Security - Part 1

This is a non-technical guide which will make you familiar with the transport layer. The main purpose of writing this guide is to point out why we need major security implementation on the transport layer. What if the components of this layer get compromised?

In this today’s digital world, every business has their website. If it is a small firm or any big agency which is government agency or non-government agency, they have a website and they use websites. It is clearly visible that number of individuals and companies who are accessing the internet has rapidly increased. As the businesses around the globe are rapidly increasing, they want the internet to be act as web e-commerce for their business to manage everything centrally. However, over the years we are watching that web services across the internet are majorly vulnerable in various ways. None of the business wants to put themselves into vulnerable environment. As a result, the need for security in the corporate world is also in demand.

If we talk about web applications/services, then it is a very broad topic. As it mentioned in title that we are going to discuss security for only those parts which are related to transport layer. So in this criteria only SSH, TLS/SSL and HTTPS come.

Security Deliberation in Web
WWW is nothing but the client/server application running on internet using TCP/IP. There are a number of security auditing tools and mechanisms which address the network security considerations, but there are many new vulnerabilities which are not appreciated by those tools and mechanisms yet.    

Unlike traditional publishing environments, internet has also 2-way which is client and servers. Attacks can be done on client application as well as a web server. Web servers are the heart of the corporate world where bunch general and sensitive information is stored. If those web servers are compromised, then reputation & the money of that organization can be lost in no time. Web browsers are easy to use and web servers are very easy to configure and manage. Thus how we produce mass digital information. Below table shows the security threats which we are facing and have faced up to now. There are two types of threats such as passive threats & active threats.

Impact of Threat
Passing Invalid Data

Impersonate Valid user
False information being accepted & Attacker may get access

Access of personal data behalf of legitimate user
Use Cryptography Mechanism
Trojan in browser

User data modification

Message modification in network traffic
Compromisation of machine

Information loss

Use Cryptography Checksums
Denial of Service
Flood server with bogus requests

Filling server memory

DNS attack for machine isolation
Legitimate users cannot work due to long waiting state

The server breaks down completely
IPS/IDS, Honeypot, Firewalls
MITM attack
Information Theft from server & client
Privacy loss
Web proxies, Encryption techniques

Passive threat : It includes man in the middle attack between server and client on the network traffic in order to gain access to the information which is being shared between them. Generally the information which attacker gains by doing  this, is restricted except that client and server.

Active threat : In this, the attacker impersonates user, network or website directly in order to gain the information which is usually restricted to see.
Apart from these two categories, we can also categorize web threats in the way they serve between client and server such as web browser, web server and network traffic.

Security Approaches in Web Traffic
There are a number of security approaches available to address each web threats. There are some common mitigation for addressing more than one threat which has the same impact, but here in network security it differs from with location. We have to see first where the service is placed within the TCP/IP stack in order to provide mitigation for that.

There are 3 levels, which plays important roles network security, they are network level, transport level and application level. The below figure illustrates the network level.

One way to provide security is to use IPSec policy which is referred as an IP Security mechanism. The Major benefit of using IPSec is that it is very transparent to end users. It is a general purpose mechanism to provide end-to-end security for both end users. One of the biggest advantage is, it uses a filtering mechanism which allows only selected traffic to let in and go. If you want to know how to implement IPSec in 2 XP end users, you should go to this link.

Now we will come to the transport level. The below figure illustrates the transport level and where we should implement security in that.

Another general purpose solution to address network security is to implement SSL (Secure Socket Layer just above the TCP. It is also referred as TLS known as transport layer security. There are two implementation choices for SSL.

1.    SSL can be provided as underlying protocol and can be separated. So it becomes transparent to that specific application.

2.    SSL can be embedded in some packages like web browsers such as Firefox, IE, Chrome. So if server wants to use it, those browsers are always up for that. Otherwise it will serve as normal HTTP.
Now we will move on to the application level. Now to understand the scenario here is the architecture for application level.

Application level security approach varies with the different application used in that. That is why it is giving more flexibility to choose a security policy according to the application’s requirement.
Thus how, we have seen where exactly we can implement security mechanisms in between different layers. In Part 2 of this series of article, I am going to unleash SSL and what roles it plays in TLS and how. Stay tuned.


No comments: