Management of Information Security, Fourth Edition 10-1
© 2014 Course Technology, Cengage Learning
Chapter 10
Protection Mechanisms
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
Management of Information Security, Fourth Edition 10-2
Lecture Notes
Overview
Chapter 10 introduces students to the topic of information security protection mechanisms.
Students will learn about the use of firewalls and IDPSs, as well as common
Chapter Objectives
After reading this chapter and completing the exercises, the student will be able to:
• Describe the various access control approaches, including authentication, authorization,
and biometric access controls
Teaching Tips
Introduction
1. Explain to students how technical controls can enable policy enforcement, such as by
enforcing password policies.
Access Controls
1. Reiterate how access controls are used to regulate admission of users into trusted areas
Identification
1. Define identification as the mechanism that provides information about an unverified
entity, or supplicant. Students should understand how a supplicant is used in
Management of Information Security, Fourth Edition 10-3
Authentication
1. Authentication should be explained as the process that validates a user’s identification.
Note the four different types of authentication:
2. Teach students that strong authentication requires at least two different authentication
mechanisms. Provide examples of such authentication, such as an automated teller
machine.
3. Describe how a user can be identified by something they know, such as by a password
6. Make students aware of how authentication can be based on something in a user’s
possession, such as a dumb card with a magnetic strip, which contains an encrypted
PIN.
7. Compare the dumb card to the smart card, which contains a computer chip that is used
to verify and validate information beyond just a PIN number.
9. Educate students on how biometric data can be used as something to uniquely identify
an individual, and note some biometric authentication methods:
a. Fingerprints
10. Note that only three biometric values are considered truly unique:
a. Fingerprints
b. Retina
c. Iris
11. Describe how something produced by a user might be used for authentication, such as a
Management of Information Security, Fourth Edition 10-4
13. Elaborate on how pattern-based approaches can be used to recognize keystroke patterns
in order to identify a user.
14. Provide students with information on how biometric data is typically evaluated using
three basic criteria:
15. The false reject rate should be explained as the rate at which authentic users are denied
or prevented access as a result of failure by the biometric device. Explain that this is
also known as a Type I error, or a false negative.
16. False accept rates can be defined as the rate at which a user is misidentified or a non-
Authorization
1. Explain how the authorization process begins with an authenticated entity, and note the
three different ways authorization is typically handled:
2. Describe the concept of single sign-on (SSO), in which a user is granted an
Accountability
1. Educate students on how accountability is used to ensure that all actions on a system
can be traced back to an authenticated identity.
2. Describe how systems logs maintain records of specific information, such as failed
4. Discuss some of the issues that can occur in log generation, such as:
a. Multiple log sources
5. Point out what functions must be addressed in order to interpret data from the Log
Generation tier:
Management of Information Security, Fourth Edition 10-5
6. Discuss the use of a security event information management (SEIM) system, which can
be used to collect logs from different systems.
7. List some of the important management functions within log storage:
a. Log rotation
8. Provide students with an overview of the important management functions within log
analysis:
9. Educate students on the process of log disposal, or log clearing, and provide them with
suggestions on proper log maintenance, such as the use of log rotation, secured logs,
Managing Access Controls
1. Describe how an access control policy controls how access rights are granted to entities
Firewalls
1. Describe a firewall as a device that prevents specific types of information from entering
The Development of Firewalls
1. Explain how a packet filtering firewall works by examining the header of every packet
passing through the firewall, and filtering packets based on IP address, type of packet,
port request, or other specific elements within a packet.
Management of Information Security, Fourth Edition 10-6
4. Describe how a demilitarized zone (DMZ) functions to provide a less restricted area for
the placement of servers that service requests from outside untrusted networks, while
separating them from internal networks.
5. Define a cache server as a server that stores the most recently accessed information
within an internal cache, for quick access.
9. Note the disadvantage a stateful firewall has when under extreme load, such as from a
denial of service attack.
10. Introduce the dynamic packet filtering firewall, which allows only a particular packet
with a specific source, destination, and port address to pass through a firewall.
Firewall Architectures
1. Explain that each of the firewall generations can be implemented in a number of
architectural configurations, and point out that the configuration used can be dependent
on different organizational specific factors.
6. Define how Network Address Translation (NAT) is used to allow private IP networks
to communicate using an external IP address, typically on a one-to-one basis.
7. Port Address Translation (PAT) should be compared to NAT. Note that PAT allows a
single public IP address to be used by many private IP addresses, through the use of
address and port (or socket) combinations.
8. Discuss the three different private IP network ranges:
Management of Information Security, Fourth Edition 10-7
Selecting the Right Firewall
1. Provide students with a list of example questions that should be asked when evaluating
Managing Firewalls
1. Explain that any firewall device, whether a packet filtering router, bastion host, or other
firewall implementation, must have its own set of configuration rules that regulate its
actions.
2. Elaborate on the potential difficulties of configuration of firewall rules, and stress the
4. List some of the administrative challenges related to the operation of firewalls:
a. Training
b. Uniqueness
Intrusion Detection and Prevention Systems
1. Describe how intrusion detection and prevention systems (IDPSs) work by detecting an
intrusion or violation on a network, and then triggering an alarm.
2. Elaborate on how an IDPS can be configured to help prevent an attack, such as by
Host-Based IDPS
1. Explain that a host-based IDPS works by configuring and classifying various categories
of systems and data files.
Management of Information Security, Fourth Edition 10-8
Network-Based IDPS
1. Explain that a network based IDPS (NIDPS) monitors network traffic using known
patterns of illegitimate traffic.
Signature-based IDPS
1. Signature-based IDPSs, or knowledge-based IDPSs can be explained as monitoring
that this requires continually updated signatures in order to catch new attack strategies.
Anomaly-Based IDPS
1. Anomaly-based IDPS (or statistical anomaly-based IDPS, or behavior-based IDPS) can
be explained as an IDPS that establishes a baseline of normal traffic and then compares
Managing Intrusion Detection and Prevention Systems
1. Make students aware of the fact that an IDPS will only record information by default,
and will take no action until properly configured to do so.
3. Educate students on how an IDPS uses an agent (or sensor) to monitor a system and
4. Describe how a consolidated enterprise management service can be used to collect data
from multiple host-based and network-based IDPSs to look for patterns.
Quick Quiz 1
1. ____________________ use a challenge response mechanism in which a server
challenges a user with a number, which a user must then enter into a device to calculate
the response number.
Management of Information Security, Fourth Edition 10-9
2. True or False: A password is typically longer than a passphrase.
3. What is the name for a network segment that exists as an intermediate area between a
trusted network and an untrusted network?
A. Proxied network zone (PNZ)
B. Sanitization zone (SZ)
C. Demilitarized zone (DMZ)
D. Internal-External zone (IEZ)
4. Which of the following is described as processes that ensure all actions on a system can
be attributed to an authenticated identity?
A. Authorization
B. Accountability
C. Identification
D. Authentication
5. What term is described as the rate at which fraudulent users or nonusers are allowed
access to systems as a result of failure within a biometric device?
A. False accept rate
B. False reject rate
C. Crossover error rate
D. False negative rate
Remote Access Protection
1. Discuss some of the vulnerabilities of providing a dial-up connection for remote access.
RADIUS and TACACS
1. Introduce the Remote Authentication Dial-In User Service (RADIUS) as a centralized
2. Compare Terminal Access Controller Access Control System (TACACS) to RADIUS,
3. Discuss the three different versions of TACACS:
a. TACACS
Management of Information Security, Fourth Edition 10–10
Managing Dial-Up Connections
1. List some of the different tasks that an organization should perform if it provides
remote access via dial-up connection:
a. Determine how many dial-up connections it has
Wireless Networking Protection
1. Explain to students the cost benefits in the use of a wireless network as opposed to a
wired network.
2. Define a wireless network footprint as the geographic area in which there is sufficient
signal strength to maintain a network connection.
Wired Equivalent Privacy (WEP)
1. Introduce the Wired Equivalent Privacy (WEP) encryption as part of the IEE 802.11
standard, and note that it can be used to provide very basic security for a wireless
Wi-Fi Protected Access (WPA)
1. Discuss the Wi-Fi Protected Access (WPA) set of protocols, which were designed as an
intermediate solution until full availability of the 802.11i standard.
2. Point out that WPA2 utilizes the 802.11i standard, and note that most wireless network
cards work with WPA, but not all cards are compatible with WPA2.
Teaching
Tip
The WEP encryption standard is easily broken by a suite of utilities collectively
known as Aircrack-ng (next generation). More information about Aircrack-ng
can be found at:
Management of Information Security, Fourth Edition 10–11
WiMax
1. Discuss WiMAX, also known as WirelessMAN, as the next generation of wireless
networking that is based on technology developed for cellphones and modems.
Bluetooth
1. Educate students on the use of Bluetooth for short-range wireless communications
between devices within a 30-foot range.
2. Stress the fact that Bluetooth devices can be extremely vulnerable without use of proper
Managing Wireless Connections
1. Explain that organizations can use a variety of different measures to protect wireless
connections, such as wireless security protocols, VPNs, firewalls, and MAC access
lists.
2. Stress the importance of properly limiting the size of the wireless network footprint, as
Scanning and Analysis Tools
1. Describe how scanners, sniffers, and other analysis tools can be used as defensive tools
by a security administrator.
2. Elaborate on footprinting, which is the organized research of Internet addresses owned
Teaching
Bluesnarfing occurs when an attacker uses Bluetooth connections to gain
Management of Information Security, Fourth Edition 10–12
Port Scanners
1. Introduce port scanners as utilities that identify the services and ports that are open on a
targeted host.
2. Explain how ports are used within the TCP/IP network protocol, and note that some
Vulnerability Scanners
1. Describe how vulnerability scanners are used to expose specific vulnerabilities on a
network. Students should be aware of the Nmap utility, which has port scanning
capabilities.
Packet Sniffers
1. Explain packet sniffers as utilities that can collect and analyze network traffic, and list
some of the available packet sniffers:
2. Discuss with students the criteria that must be met in order to use a packet sniffer
legally:
a. Must be on a network that the organization owns, not leases
Teaching
The Nmap utility is an excellent cross platform utility for examining the security
Teaching
Wireshark, and packet sniffers in general, are very commonly used to
Management of Information Security, Fourth Edition 10–13
Content Filters
1. Explain how a content filter can be used to restrict content that enters into a network,
such as the restriction of access to web sites with nonbusiness-related material.
Trap and Trace
1. Describe trap and trace applications, which are used to entice individuals who are
distract potential attackers.
Managing Scanning and Analysis Tools
1. Educate students on the use of security and scanning tools to periodically evaluate an
Cryptography
1. Elaborate on how cryptography is used to ensure confidentiality by keeping private
information concealed from unauthorized users.
2. Define nonrepudiation as the verification of transactions and involved parties, so that
Encryption Operations
1. Explain that encryption is accomplished by using algorithms to manipulate the plaintext
into the ciphertext for transmission.
2. Introduce the substitution cipher, which substitutes one value for another value. Provide
Management of Information Security, Fourth Edition 10–14
4. Point out that transposition ciphers and substitution ciphers can be used together to
create stronger encryption.
5. Describe how the XOR cipher conversion works by performing a Boolean XOR
the page number, line number, and word number of the plaintext word.
8. Describe how private key encryption, or symmetric encryption, is used in conjunction
with a secret key that is used to encipher and decipher a message. Make students aware
of the challenge of getting a copy of the key to a receiver, which must be conducted out
of band.
9. Discuss Data Encryption Standard (DES) as a standard that uses 64-bit block sizes and
a 56-bit key. Point out that this standard was replaced by the Triple DES (3DES)
standard which uses three keys in succession.
12. Make students aware of the disadvantage in the need for four keys in order to establish
secure communications when using asymmetric encryption.
13. Describe how digital signatures make use of encrypted messages whose authenticity
can be independently verified by a central facility, and can also be used to prove certain
characteristics of the message or file with which they are associated.
14. Digital certificates should be explained as being similar to digital signatures, that certify
17. Describe how organizations can increase cryptographic capabilities in protecting
information assets by providing the following services:
a. Authentication
b. Integrity
Management of Information Security, Fourth Edition 10–15
18. Discuss how a hybrid encryption system can be used to combine asymmetric key
encryption with symmetric key encryption, and note that the Diffie-Hellman key
Using Cryptographic Controls
1. Explain that proper management (policy, planning and proper implementation) is
2. Point out some of the different uses of cryptographic controls, such as to provide
confidentiality and integrity of e-mail and its attachments.
3. Discuss some of the cryptosystems that have been used to secure e-mail, such as:
a. Secure Multipurpose Internet Mail Extensions (S/MIME), which builds on the
4. Describe some of the different cryptosystems used to secure web activity, such as:
a. Secure Electronic Transactions (SET), which encrypts credit card transfers with
DES and uses RSA for key exchange.
5. Discuss some of the different cryptosystems that are combined under the IPSEC
protocol:
a. Diffie-Hellman key exchange
b. Public key cryptography
c. Bulk encryption algorithms
d. Digital certificates
6. Educate students on the two different components of IPSec: the IP Security protocol
itself, and the Internet Key Exchange (IKE).
Management of Information Security, Fourth Edition 10–16
9. Discuss the use of the Kerberos system for authentication, and note that it uses
symmetric key encryption to validate access to resources.
10. Educate students on how Kerberos uses a ticketing system to authenticate users, and list
Managing Cryptographic Controls
1. Discuss some of the more important managerial issues related to cryptographic
controls, such as the need for keeping keys secure, and understanding encryption
Quick Quiz 2
1. The ____________________ is the successor to 3DES, and has a key length of 128,
192, or 256 bits.
2. True or False: The XOR cipher conversion is a reversible process.
3. After plaintext messages have been encrypted, the encrypted text is known as
__________.
4. What is the range for well-known ports in the TCP/IP protocol suite?
A. 0 through 1023
B. 1024 through 49,151
C. 49,152 through 65,535
D. 1024 through 65,535
5. Wireshark is an example of what type of utility?
A. Port scanner
B. Content filter
C. Packet sniffer
D. Vulnerability scanner
Management of Information Security, Fourth Edition 10–17
Class Discussion Topics
1. Start a class discussion on the use of firewalls within organizations of different sizes.
How might a firewall be implemented in a small organization in comparison to a large
one?
2. Ask students whether or not they use wireless security protocols within their home
Additional Projects
1. Task students with setting up an SSH server and using a packet sniffer such as
2. Have students research some of the different studies done on the vulnerabilities in
Additional Resources
1. Blog article featuring an animation on how AES works: