FIT3031 Lecture Notes - Lecture 5: Session Id, Hash-Based Message Authentication Code, Internet Standard
22 Jun 2018
School
Department
Course
Professor
L5: Web Security
As more and more big organisaon have website they are more prone to web security threats. The
following table shows the threat, the consequences and the countermeasure for the threat.
Threat
Consequence
Countermeasure
Integrity
●Modificaon of user data
●Trojan horse browser
●Modificaon of memory
●Modificaon of message
traffic in transit
●Loss of informaon
●Compromise of machine
●Vulnerability to all other
threats
Cryptographic checksums
Confidentiality
●Eavesdropping on the net
●The of info from server
●The of data from client
●Info about network
configuraon
●Info about which client
talks to server
●Loss of informaon
●Loss of privacy
●Encrypon
●Web proxies
Denial of Service
●Killing of user threads
●Flooding machine with
fake requests
●Filling up disk or memory
●Isolang machine by DNS
aacks
●Disrupve
●Annoying
●Prevent user from geng
work done
Difficult to prevent
Authentication
●Impersonaon of
legimate users
●Data forgery
●Misrepresentaon of user
●Belief that false info in
valid
Cryptographic techniques
Web Traffic Security Approaches
a. IPsec:
○ A more general approach to provide security for any applicaon that you can pick or
choose
○Filters traffic
○Transparent to end users and applicaons
Document Summary
As (cid:373)o(cid:396)e a(cid:374)d (cid:373)o(cid:396)e (cid:271)ig o(cid:396)ga(cid:374)isa(cid:415)o(cid:374) ha(cid:448)e (cid:449)e(cid:271)site the(cid:455) a(cid:396)e (cid:373)o(cid:396)e p(cid:396)o(cid:374)e to (cid:449)e(cid:271) se(cid:272)u(cid:396)it(cid:455) th(cid:396)eats. The follo(cid:449)i(cid:374)g ta(cid:271)le sho(cid:449)s the th(cid:396)eat, the (cid:272)o(cid:374)se(cid:395)ue(cid:374)(cid:272)es a(cid:374)d the (cid:272)ou(cid:374)te(cid:396)(cid:373)easu(cid:396)e fo(cid:396) the th(cid:396)eat. I(cid:374)fo a(cid:271)out (cid:449)hi(cid:272)h (cid:272)lie(cid:374)t talks to se(cid:396)(cid:448)e(cid:396) A (cid:373)o(cid:396)e ge(cid:374)e(cid:396)al app(cid:396)oa(cid:272)h to p(cid:396)o(cid:448)ide se(cid:272)u(cid:396)it(cid:455) fo(cid:396) a(cid:374)(cid:455) appli(cid:272)a(cid:415)o(cid:374) that (cid:455)ou (cid:272)a(cid:374) pi(cid:272)k o(cid:396) (cid:272)hoose. Fo(cid:272)uses o(cid:374)l(cid:455) o(cid:374) t(cid:396)a(cid:374)spo(cid:396)t th(cid:396)ough ssl/tls, gi(cid:448)es se(cid:272)u(cid:396)it(cid:455) to spe(cid:272)i (cid:272) appli(cid:272)a(cid:415)o(cid:374), fo(cid:396) e(cid:454)a(cid:373)ple, the (cid:449)e(cid:271) Makes use of (cid:396)elia(cid:271)ilit(cid:455) a(cid:374)d o(cid:449) (cid:272)o(cid:374)t(cid:396)ol of tcp (cid:272). Fo(cid:272)uses o(cid:374)l(cid:455) o(cid:374) appli(cid:272)a(cid:415)o(cid:374) a(cid:374)d ha(cid:448)e se(cid:272)u(cid:396)it(cid:455) featu(cid:396)e (cid:271)uilt i(cid:374)to it. Se(cid:396)(cid:448)i(cid:272)e (cid:272)a(cid:374) (cid:271)e tailo(cid:396)ed to the (cid:374)eeds of gi(cid:448)e(cid:374) appli(cid:272)a(cid:415)o(cid:374) Ho(cid:449)e(cid:448)e(cid:396), (cid:449)e usuall(cid:455) pi(cid:272)k o(cid:374)e to a(cid:448)oid (cid:271)u(cid:396)de(cid:374)i(cid:374)g the (cid:272)o(cid:373)(cid:373)u(cid:374)i(cid:272)a(cid:415)o(cid:374) a(cid:374)d speed. A (cid:374)e(cid:449) la(cid:455)e(cid:396) i(cid:374)se(cid:396)ted (cid:271)et(cid:449)ee(cid:374) t(cid:396)a(cid:374)spo(cid:396)t la(cid:455)e(cid:396) a(cid:374)d appli(cid:272)a(cid:415)o(cid:374) la(cid:455)e(cid:396). Server authentication : se(cid:396)(cid:448)e(cid:396)"s ide(cid:374)(cid:415)t(cid:455) is (cid:272)o(cid:374) (cid:396)(cid:373)ed to the (cid:272)lie(cid:374)t, (cid:271)(cid:455) de(cid:373)o(cid:374)st(cid:396)a(cid:415)(cid:374)g (cid:448)alid (cid:272)e(cid:396)(cid:415) (cid:272)ate o(cid:396) pu(cid:271)li(cid:272) ke(cid:455) Confidentiality : data ite(cid:373)s t(cid:396)a(cid:374)sfe(cid:396)(cid:396)ed i(cid:374) the sessio(cid:374) a(cid:396)e e(cid:374)(cid:272)(cid:396)(cid:455)pted to p(cid:396)ote(cid:272)t agai(cid:374)st ea(cid:448)esd(cid:396)oppi(cid:374)g.
