Spoofing involves masquerading as another entity on a network to gain unauthorized access. Common spoofing attacks include masquerading as another system, hijacking an existing user session, and man-in-the-middle attacks where a third party intercepts communications. Intrusion detection systems monitor network activity for unusual behavior or policy violations and can help detect spoofing and other attacks. Firewalls filter network traffic to protect systems and enforce security policies, blocking unauthorized access while allowing legitimate communications.

1. SPOOFING

2. Computer Network Security 2
Spoofing
Guessing or otherwise obtaining the
network authentication credentials of an
entity (a user, an account, a process, a node,
a device) permits an attacker to create a full
communication under the entity’s identity.
Examples of spoofing are masquerading,
session hijacking, and man-in-the-middle
attacks.

3. Computer Network Security 3
Masquerade
In a masquerade one host pretends to be another.
A common example is URL confusion. e.g. coca-
cola.com vs cocacola.com; xyz.net vs xyz.com
Domain names can easily be confused, or
someone can easily mistype certain names.
In another version of a masquerade, the attacker
exploits a flaw in the victim’s web server and is
able to overwrite the victim’s web pages.
Collect user information and perhaps pass it on to
the original

4. Computer Network Security 4
Session hijacking
Session hijacking is intercepting and carrying on a session
begun by another entity.
Suppose two entities have entered into a session but then a
third entity intercepts the traffic and carries on the session
in the name of the other.
A different type of example involves an interactive
session, e.g. If a system administrator logs in remotely to a
privileged account, a session hijack utility could intrude in
the communication and pass commands as if they came
from the administrator.

5. Computer Network Security 5
Man-in-the-Middle Attack
A man-in-the-middle attack is a similar form of
attack, in which one entity intrudes between two
others.
The difference between man-in-the-middle and
hijacking is that a man-in-the-middle usually
participates from the start of the session, whereas
a session hijacking occurs after a session has been
established.
The difference is largely semantic and not too
significant.

6. Computer Network Security 6
Man-in-the-Middle Attack
Man-in-the-middle attacks are frequently described in
protocols. To see how, suppose you want to exchange
encrypted information with your friend.
You contact the key server and ask for a secret key with
which to communicate with your friend. The key server
responds by sending a key to you and your friend.
One man-in-the-middle attack assumes someone can see
and enter into all parts of this protocol.
A malicious middleman intercepts the response key and
can then eavesdrop on, or even decrypt, modify, and re-
encrypt any subsequent communications between you and
your friend.

7. Intrusion Detection Systems
(IDS)

8. Computer Network Security 8
Intrusion Detection Systems (IDS)
An IDS is like an alarm system for your network.
The network is protected, but without the IDS (alarm), you
would never know whether an attacker was trying to gain
entry.
The goal of Intrusion detection is to monitor network
assets to detect unusual behaviour, inappropriate activity,
and attacks, or stop the attack (intrusion) and even provide
information to prosecute the attacker.
IDSs function on three premises:
Where to watch
What to watch for
What to do

9. Computer Network Security 9
Intrusion Detection Systems (IDS)
The first premises “where to watch” tells the IDS the
logical location it will be monitoring for something to
happen.
The Second premises “what to watch for” tells the IDS
conditions for which it is supposed to be looking for to
raise an alarm or some kind of action.
The Third premises “what to do” is the action the IDS
has been told to take when a situation meets certain
parameters.
Real world examples of an IDS in action.
1. you install an IDs to watch the internet connection and those
trying to get into your network through your firewall.

10. Computer Network Security 10
Intrusion Detection Systems (IDS)
2. You tell the IDS what types of hacks and attacks to look for based
on their packet and connection type and what activities these
might generate.
3. You tell the IDS to page you and send you an e-mail when one of
these attacks occurs.
There are some flaws in the whole IDS operating
principle.
First, the IDS can watch only one interface at a time.
Secondly, the IDS watches only for conditions that you
tell it about.
Finally, an IDS can actually become an ally to hackers.

11. Computer Network Security 11
Intrusion Detection Systems (IDS)
IDS can be deployed in a variety of
locations within a network to further
increase in organization’s security and
protection.
In general, two basic forms of IDS are used
today.
Network intrusion detection system (NIDS).
Host intrusion detection system (HIDS).

12. Computer Network Security 12
Network Intrusion Detection Systems
(NIDS)
NIDS reside directly on the n/w and watches all
the traffic that traverses the n/w.
NIDS are effective at both watching for
inbound/outbound traffic flows and traffic
between hosts on or between local n/w segments.
NIDS are typically deployed in front of and
behind firewalls and VPN gateways to measure
the effectiveness of those security devices and
interact with them to add more depth to the
networks security.

13. Computer Network Security 13
Host Intrusion Detection Systems
(HIDS)
HIDS are specialized software application that are
installed on a computer (typically a user) to watch
all inbound and outbound communication traffic
to and from that server and to monitor the file
system for changes.
HIDS are extremely effective on mission-critical,
internet-accessible application server, such as web
server or e-mail servers, because they can watch
the application at source to protect them.

14. Computer Network Security 14
Intrusion Detection Systems (IDS)
Both types of sensors offer different
techniques for detecting and deferring
malicious activity.
Both should be deployed to provide the
most effective enhancement to a layered
defence strategy.

15. FIREWALLS

16. Computer Network Security 16
What is a Firewall?
A firewall is a security device that sits on the edge
of your Internet connection and functions as an
Internet Border Security Officer.
It constantly looks at all the traffic entering and
exiting your connection, waiting for traffic it can
block or reject in response to an established rule.
The firewall is law and protection in a lawless
global web.
Firewalls can protect both individual computer
and corporate networks from hostile intrusions
from the internet.

17. Computer Network Security 17
Why Do I Need a Firewall?
It is no secret: hackers are out there, and they are
out to get us. Often, we do not know who they are,
but we do know where they are and where we do
not want them to be (in our n/w).
Like pirates of old roamed the seas, hackers roam
the wide expanses of the internet. You do not want
them to enter your n/w and roam among the
computers that connect to it.
You know that you must protect your n/w from
these attackers, and one of the most efficient
methods of protecting your n/w is to install a
firewall.

18. Computer Network Security 18
Why Do I Need a Firewall?
By default, any good firewall prevent n/w traffic
from passing between the internet and your
internal n/w. this does not mean that the firewall
will stop all traffic-that defeats the purpose of
being on the internet.
It does mean that the firewall is configured to
allow only web browsing (HTTP/port 80) to
access it from the internet.
Technically, a firewall is a specialized version of a
router. Apart from the basic routing functions and
rules, a router can be configured to perform the
firewall functionality, with the help of additional
software resources.

19. Computer Network Security 19
Common rules and features
Block incoming n/w traffic based on source or
destination- blocking unwanted incoming traffic is the
most common features of a firewall and is the main reason
for a firewall.
Block outgoing n/w traffic based on source or
destination- many firewalls can also screen n/w traffic
from your internal n/w to the internet. E.g. prevent your
employee from accessing inappropriate websites.
Block n/w traffic based on content- More advanced
firewall can screen n/w traffic for unacceptable content.
E.g. a firewall that is integrated with a virus scanner can
prevent files that contain viruses from entering your n/w.

20. Computer Network Security 20
Common rules and features
Make internal resources available- Although the
primary purpose of a firewall is to prevent
unwanted n/w traffic from passing through it, you
can configure many firewalls to allow selective
access to internal resources, such as a public web
server, while still preventing other access from the
internet to your internal n/w.
Allow connections to internal n/w- A Common
method for employee to connect to a n/w is using
virtual private n/w (VPNs). VPNs allow to secure
connections from the internet to a corporate
networks. E.g. telesales and travelling people can
use a VPN to connect to corporate n/w

21. Computer Network Security 21
Common rules and features
Make internal resources available-When
screening n/w traffic to and from the
internet, it is also important to know what
your firewall is doing, who tried to break
into your n/w, and who tried to access
inappropriate material on the internet.

22. Computer Network Security 22
Implementing a Firewall
The choice of available firewalls is almost
mind-boggling theses days; they come in
every shape, size and parameter.
The type of firewall you install depends on
exact requirement for protection and
management, as well as the size of your n/w
or what is to be protected by the firewall.
Firewalls usually fall into one of the
following categories

23. Computer Network Security 23
Implementing a Firewall
Persona firewall- is usually a piece of software that is
installed on a single PC to protect only the PC. These type
of firewalls are usually deployed on home PCs with
broadband connections or remote employees.
All-in-one-firewall- These kinds of firewalls are widely
used by broadband (cable or DSL) subscribers who have
the benefit of a single device that offers the following
features and functionality: router, Ethernet switches, WAP
and a firewall.
Small-to-medium office firewalls- These firewalls, such
as the Cisco PIX 501 or 506, are designed to provide
security and protection for small offices.
Enterprise firewalls- These firewalls, such as the Cisco
PIX 515, are designed for larger organization with
thousands of users.

24. Computer Network Security 24
ANY QUESTIONS
?