Network Security & Management: Threats, Protocols, Firewalls, VPNs & Monitoring

Network Security Fundamentals: CIA Triad and Threats

The CIA Triad: Core Security Principles

Network security revolves around three pillars visualized below:

mindmap
  root((CIA Triad))
    Confidentiality
      Definition: Ensuring data is accessible only to authorized users
      Example: Encrypted eSewa transactions
    Integrity
      Definition: Protecting data from unauthorized modification
      Example: Digital signatures in NEPSE stock trades
    Availability
      Definition: Ensuring systems are operational when needed
      Example: Ncell's 99.99% uptime SLA

Key Threats that violate these principles:

Security Protocols: How Data Travels Safely

IPSec (Internet Protocol Security)

Real-world use: WhatsApp uses IPSec-like encryption for end-to-end messages between servers.

SSL/TLS Handshake (Transport Layer Security)

Worked Example: When you log into eSewa:

1. Your browser sends TLS 1.3 handshake
2. eSewa's server presents its certificate from GlobalSign
3. Your device verifies the certificate chain
4. Symmetric keys are established for session encryption

Firewalls: The Network's First Line of Defense

Firewall Types Comparison

Real-world deployment:

• Ncell uses stateful firewalls to protect its core network
• Banks implement NGFWs to detect SQL injection attempts in online transactions

Virtual Private Networks (VPNs)

How VPNs Work

VPN Protocols Comparison:

Real-world example: When Daraz employees access internal systems from home, they use OpenVPN with AES-256 encryption to prevent MITM attacks on their WiFi connections.

Intrusion Detection Systems (IDS)

IDS vs IPS

classDiagram
    class IDS {
        +Detects anomalies
        +Passive monitoring
        +Generates alerts
    }
    class IPS {
        +Detects AND prevents
        +Active intervention
        +Inline inspection
    }
    IDS <|-- IPS : "Extends"

Signature-based vs Anomaly-based Detection:

Real-world deployment: NTC uses hybrid IDS/IPS systems to detect:

• Unusual routing table changes (potential BGP hijacking)
• Port scans targeting their DNS servers

Network Management: Keeping Systems Healthy

SNMP (Simple Network Management Protocol)

SNMP Commands:

• GET: Retrieve device information
• SET: Configure device parameters
• TRAP: Send unsolicited alerts

Real-world use: Ncell uses SNMP to:

1. Monitor 4G tower temperatures
2. Track bandwidth usage per cell
3. Receive immediate alerts when a tower goes offline

RMON (Remote Monitoring)

RMON Groups:

1. Statistics (packets/errors)
2. History (trends over time)
3. Alarms (threshold breaches)
4. Events (specific conditions)

Worked Example: At a university network:

• RMON detects a sudden spike in broadcast traffic
• SNMP identifies the faulty switch port
• NMS (Network Management System) automatically logs the incident

Security Management Frameworks

ISO 27001 Implementation Steps

Real-world application: Banks in Nepal implement ISO 27001 for:

• Secure online transaction processing
• Employee access controls
• Regular security audits

Exam Tip: How to Score Full Marks

1. Diagrams are worth 20% of marks: Always draw:

   • Firewall architectures
   • VPN tunnel diagrams
   • Protocol handshakes (3-way handshake, TLS)
   • Attack vectors (MITM, DoS)

2. Real-world mapping: For every concept, mention:

   • How eSewa/Khalti uses it (encryption, authentication)
   • How Ncell protects its network (firewalls, IDS)
   • How Daraz handles DDoS attacks (rate limiting)

3. Comparison tables: The exam loves:

   • Firewall types (packet-filtering vs stateful)
   • VPN protocols (PPTP vs OpenVPN)
   • IDS vs IPS capabilities

4. Numerical problems: Practice calculating:

   • Throughput degradation from attacks (e.g., 50% packet loss from DoS)
   • Encryption overhead (e.g., 10% increase in packet size with AES-256)
   • False positive rates for IDS systems

5. Short notes format: For 5-mark questions:

   • Definition (1 mark)
   • Working principle (2 marks)
   • Real-world example (1 mark)
   • Advantage/disadvantage (1 mark)

Key Formulae to Memorize:

1. Throughput with attacks: $S=G\times e^{-2a}$ (for ALOHA networks)
   • Where $S$ = throughput, $G$ = offered load, $a$ = frame collision probability
2. Encryption overhead: $\text{New Size}=\text{Original}\times (1+\frac{\text{IV Size}+\text{Auth Tag}}{\text{Plaintext Size}})$
3. False positive rate: $\frac{\text{False Alarms}}{\text{False Alarms}+\text{Correct Negatives}}$