1. Application Layer Protocols

Application layer protocols facilitate communication and data sharing between software applications on various network devices. They operate at the application layer of the OSI and TCP/IP models.

HTTP (Hypertext Transfer Protocol)

• Port Allocation: Operates by default over Port 80.
• Transport Baseline: Relies entirely on TCP at the transport layer for data delivery reliability.
• Architectural State: Completely Stateless—the server retains no information or history about previous client requests.
• In-band Behavior: Control commands and actual data are sent together through the same channel.

HTTP 1.0 (Non-Persistent)	HTTP 1.1 (Persistent)
Every single request/response pair requires establishing a brand new TCP connection.	Keeps the TCP connection open across multiple successive object requests.
High overhead due to constant connection handshakes.	Greatly reduces network latency and resource consumption.

Core Commands: GET, POST, HEAD, PUT, DELETE, and CONNECT.

FTP & Email Protocols (SMTP / POP)

---

2. Email Security & Threat Mitigation

Email is pervasive and highly vulnerable. Threats target Authenticity, Integrity, Confidentiality, and Availability.

Core Email Security Protocols

To combat these threats, standard protocols are used to ensure the source is valid and content is unaltered:

• SPF (Sender Policy Framework): Uses DNS TXT records to associate a domain name with authorized IP address ranges. Checks if mail is sent from an authorized server.
• DKIM (DomainKeys Identified Mail): Enables an MTA (Mail Transfer Agent) to add a digital signature to selected headers and the message body, validating the source domain and ensuring body integrity.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Combines SPF + DKIM. Signals to receiving servers exactly how to handle emails that fail authentication (fake emails).
• S/MIME (Secure/Multipurpose Internet Mail Extension): Provides message confidentiality (encryption) and authentication/integrity (digital signatures) using RSA Data Security and X.509v3 certificates (RFC 5750). Converts entire bodies into a Canonical form prior to processing.
• STARTTLS: An SMTP extension providing authentication, integrity, and confidentiality by running the entire SMTP message over TLS.
• DANE & DNSSEC: DANE provides an alternative channel for authenticating public keys based on DNSSEC, which protects the integrity of DNS data itself.

---

3. Common Web Attacks

Cross-Site Scripting (XSS)

A vulnerability allowing a third party to execute a script in the user's browser on behalf of the web application. Impacts include account compromise, privilege escalation, and malware infection.

Type of XSS	Mechanism
Reflected XSS	Payload is delivered directly to the victim and embedded in the server's immediate response (e.g., malicious script in a search field URL).
Stored XSS	Payload is permanently stored on the target server (e.g., in a comment thread) and executes automatically on every user visit without manual submission.
DOM Based XSS	Happens completely in the browser (client-side) modifying the Document Object Model via JavaScript. The server may never even see the malicious payload.

SQL Injection (SQLi)

Exploits improper input sanitization to manipulate backend databases. It can expose sensitive data, bypass logins, and result in full database compromise.

---

4. Access Control Models & Firewalls

Formal Access Control Models

Firewall Processing Modes

Firewalls separate untrusted networks (the Internet) from trusted internal networks. They fall into several major categories:

1. Packet-Filtering Firewalls: Examines header information (IP, UDP/TCP port, direction) at OSI Layer 3 (Network). Rules enforce address restrictions via ACLs.
   • Static: Rules developed and installed manually by administrators.
   • Dynamic: Can react to emergent events and update/create rules dynamically (e.g., dropping packets upon detecting malformed traffic).
2. Stateful Packet Inspection (SPI) Firewalls: Also known as stateful inspection. Keeps track of each network connection between internal and external systems using a State Table. It tracks Source IP/Port, Destination IP/Port, Protocol, and Time Remaining. Requires more processing but speeds up responses to recognized/established connections.
3. Application Layer Proxy Firewalls: Operates at the application layer. Frequently installed on a dedicated proxy server in a DMZ. Intercepts requests on behalf of the client. Disadvantage: Typically restricted to a single application (FTP, HTTP, SMTP) due to high processing requirements for deep inspection.
4. MAC Layer Firewalls: Make filtering decisions based on the specific host computer's MAC address at the Data Link layer (OSI Layer 2).
5. Hybrid Firewalls / NextGen (NGFW) / UTM: Combines multiple methodologies (e.g., packet filtering + proxy). Unified Threat Management (UTM) devices integrate SPI, IPS/IDS, spam filters, and malware scanners into a single appliance.

---

5. Virtual Private Networks (VPNs)

A VPN is a private data network utilizing public telecommunications (the Internet) coupled with tunneling protocols and cryptographic security procedures.

Types of VPNs

• Trusted VPN (Legacy): Uses leased circuits from a service provider. The organization relies on contractual assurance that circuits are safe and unshared.
• Secure VPN: Uses security protocols like IPSec to encrypt traffic transmitted across unsecured public networks.
• Hybrid VPN: Combines trusted (leased lines) with secure VPN encryption.

IPSec: Transport vs. Tunnel Mode

IPSec is the dominant protocol in VPNs. It can operate in two modes:

Transport Mode	Tunnel Mode (Implied Context)
Data (payload) within the IP packet is encrypted, but the header is not.	Entire IP packet (header and data) is encrypted and encapsulated into a new IP packet.
Allows user to establish a direct secure link with a remote host. (End-to-End communication).	Typically used between gateways (e.g., router to router) hiding the internal network topology.
Downside: Eavesdroppers can still identify the destination and packet flow.	Prevents traffic analysis since original headers are hidden.
Great for telecommuting employees connecting directly to a server.	Used when connecting an entire remote branch office to headquarters.

6. TLS & SSL Architecture

Secure Sockets Layer (SSL) was developed by Netscape. It has been deprecated by the IETF due to vulnerabilities and replaced by Transport Layer Security (TLS) (current major versions are 1.2 / RFC 5246 and 1.3). TLS provides reliable end-to-end secure services over TCP.

Security Placement in the TCP/IP Stack

• Network Level (IPSec): Transparent to end-users/applications; general-purpose.
• Transport Level (SSL/TLS): Implemented just above TCP. Can be embedded in specific packages (e.g., web browsers).
• Application Level (S/MIME, Kerberos, S-HTTP): Service is tailored specifically to the needs of a given application.

TLS Architecture Concepts

TLS is not a single protocol, but two layers of protocols. Two critical concepts govern its operation:

The 4 TLS Specific Protocols

1. TLS Record Protocol

Provides basic security services (Confidentiality via symmetric encryption and Message Integrity via MAC) to higher-layer protocols like HTTP. The operation steps are:

1. Fragmentation: Data is fragmented into blocks of 2¹⁴ bytes (16,384 bytes) or less.
2. Compression: Optional lossless compression (must not increase content length by more than 1024 bytes).
3. Add MAC: Computes a Message Authentication Code over the compressed data using HMAC (MD5 or SHA-1).
4. Encrypt: Compressed message + MAC are encrypted using symmetric ciphers (AES, 3DES, RC4).
5. Append Header: Prepends a header containing Content Type, Major/Minor Version, and Compressed Length.

2. Change Cipher Spec Protocol

The simplest protocol. Consists of a single message (1 byte with the value 1). Causes the pending state to be copied into the current state, updating the cipher suite used on the connection.

3. Alert Protocol

Conveys TLS-related alerts. The first byte indicates severity: warning (1) or fatal (2). Fatal alerts immediately terminate the connection. Examples of fatal alerts:

• unexpected_message: Inappropriate message received.
• bad_record_mac: Incorrect MAC received.
• handshake_failure: Unable to negotiate an acceptable set of security parameters.

4. TLS Handshake Protocol

The most complex part of TLS. Allows server and client to mutually authenticate, negotiate encryption/MAC algorithms, and establish cryptographic keys before application data is transmitted.

Supported Key Exchange Methods

• RSA: Secret key encrypted with receiver's public key.
• Fixed Diffie-Hellman: Public key parameters are fixed and stored in the certificate.
• Ephemeral Diffie-Hellman: Creates temporary, one-time secret keys signed using sender's private RSA/DSS key. The most secure option (Perfect Forward Secrecy).
• Anonymous Diffie-Hellman: No authentication. Highly vulnerable to Man-in-the-Middle (MITM) attacks.

---

7. Cryptography & Hashing

Encryption Types

Digital Signatures

A cryptographic technique verifying authenticity, integrity, and non-repudiation of a digital message. Relies on asymmetric cryptography.

Digital Signature	Electronic Signature
Cryptographic mechanism using Public Key Infrastructure (PKI).	Generic electronic consent method (e.g., typing a name, clicking "I Agree").
Ensures authentication, integrity, and non-repudiation.	Mainly indicates intent or approval. May not use cryptography.
High security, tamper-evident. Used for legally sensitive transactions.	Security depends on basic implementation. Used for general agreements.

Digital Certificates

An electronic document issued by a trusted Certificate Authority (CA) that binds an identity to a public key (Standard: X.509).

• Contents: Name of holder, Unique serial number, Validity period, Public key of the holder, and the Digital Signature of the issuing CA.
• Advantages: Network security against MITM, builds user trust, enables HTTPS.
• Disadvantages: Costs money, complex installation, requires strict management to prevent expiry or private key compromise.

---

Cryptographic Hash Functions

Mathematical algorithms that transform input data of any size into a fixed-length sequence of characters (hash value / digest). Used for password storage, data integrity checks, and digital signatures.

Popular Cryptographic Hash Algorithms

Hash Function	Encryption
One-way process; original data cannot be recovered.	Two-way process; original data can be recovered using a decryption key.
Fixed-length output regardless of input size.	Output size varies, usually similar to input size.
Ensures Data Integrity and Authenticity.	Ensures Data Confidentiality.

8. GDPR Compliance

The General Data Protection Regulation (GDPR) is a comprehensive law enacted by the European Union (EU) governing how personally identifiable information (PII) is collected, processed, and deleted. It became fully effective on May 15, 2018 (replacing the 1995 EU Data Protection Directive).

Key Features & Terminology

• Roles: Requires the Data Controller and Data Processor to designate a Data Protection Officer (DPO) to oversee data security strategy.
• Territorial Scope: Applies to any company processing personal data of EU citizens, regardless of the company's geographical location.
• Consent Matters: Enterprises must obtain "clear, affirmative action voluntarily given, specific, informed, and unambiguous authorization" before processing data.
• Breach Notification: Breaches must be reported to the Data Protection Authority within 72 hours of discovery.
• Right to be Forgotten: Allows subjects to request data deletion. Note: This creates compliance conflicts with immutable technologies like Blockchain (e.g., Hyperledger Fabric).
• Privacy by Design: Data protection must be built in from system inception, not as an afterthought.

Roles in Organizational Compliance

Compliance involves multiple departments. For example, Workplace compliance falls to HR, while legal risks are handled by the General Counsel (GC) or Chief Legal Officer (CLO). Reporting to the CLO maintains attorney-client privilege, protecting internal communications from legal disclosure.

6 Steps to Ensure GDPR Compliance

• Understand the Law: Conduct a compliance audit to understand obligations for collection, processing, and storage.
• Examine Other Organizations: Learn from peers who have successfully reached compliance.
• Classify Data: Identify all PII, where it is stored, who has access, and whether it falls into special categories.
• Website Attention: Modify forms, cookies, and opt-ins to obtain explicit consent.
• Data Paths: Map exactly how data enters, is stored, transferred, and deleted.
• Revise and Audit: Continuously review and patch flaws. Ensure data is not shared for unrelated purposes.

---

9. IDS, IPS & Malware

Intrusion Detection System (IDS)

An IDS is a passive "watchdog" security tool that monitors network traffic or system activities to detect unauthorized access or suspicious behavior. It alerts administrators but does not actively block attacks.

Other Types: Hybrid IDS (combines NIDS+HIDS, e.g., Prelude), APIDS (Application Protocol-Based, monitors specific app traffic like SQL), PIDS (Protocol-Based, monitors traffic like HTTPS for deviations).

Signature-Based Detection	Anomaly-Based Detection
Relies on predefined patterns (signatures) of known attacks.	Uses ML/statistical models to define "normal" baseline behavior; flags deviations.
Highly effective for known threats; very low false positives.	Can detect zero-day/unknown attacks.
Blind to new or unknown attacks until the database is updated.	Suffers from a high rate of false positives.

Intrusion Prevention System (IPS)

An IPS extends IDS capabilities by operating in-line (directly in the flow of traffic). It actively monitors network traffic in real-time and automatically blocks malicious activity before it reaches the target.

• Traffic Preprocessing: Performs Traffic Normalization (standardizing formats to prevent encoding evasion) and Packet Reassembly (rebuilding fragmented packets for inspection).
• Deep Packet Inspection (DPI): Analyzes Network layer (origins), Transport layer (connection integrity), and App layer (data payloads).
• Automated Responses: Can drop malicious packets, block source IPs, terminate suspicious sessions, or update firewall rules dynamically.

Firewall	IDS	IPS
Restricts traffic based on predefined rules (IP, Port).	Passive watchdog. Detects and alerts on suspicious payloads.	Active inline defense. Detects and blocks malicious payloads.

---

Malware and its Types

Malware (malicious software) disrupts operations, steals data, or allows remote control of systems.

Other Types: Botnets (networks of infected zombie devices controlled by a hacker for DDoS attacks), Adware (unwanted ads targeting browser behavior).

10. OWASP Top 10 (2021)

The Open Web Application Security Project (OWASP) Top 10 is the industry-standard awareness document highlighting the most critical web application security risks.

---

11. Session Management & Hijacking

Because HTTP is a stateless protocol, websites use sessions to correlate a series of requests from a single client. An authenticated user's session state is highly valuable to attackers.

Centralized vs. Decentralized Session Management

Centralized Session Management	Decentralized Session Management (e.g., JWT)
User's state is stored on the server (e.g., in a database).	User's state is stored in the client as a digitally signed token (JSON Web Token).
Server generates a random Session ID, sends it to the client, and looks it up on each request.	Server issues a token. Client presents it; server cryptographically verifies the signature to grant access.
Easy to invalidate/revoke (simply delete the ID from the server database).	Hard to revoke before expiration since it is self-contained. Requires Access Tokens (short life) and Refresh Tokens.

Session ID Storage & Transmission

Session IDs must contain at least 64 bits of entropy to prevent prediction attacks. They should be stored in Cookies rather than Local Storage or URL parameters.

• HttpOnly flag: Prevents JavaScript from accessing the cookie, heavily mitigating XSS-based theft.
• Secure flag: Ensures the cookie is only transmitted over encrypted (HTTPS) connections, preventing MITM sniffing.
• SameSite flag (Strict/Lax): Protects against Cross-Site Request Forgery (CSRF).

Session Hijacking Mechanics

Session hijacking allows an attacker to take over a legitimate user's session and impersonate them. Real-world examples include Zoom bombing, Slack cookie theft, and GitLab token flaws.