Lecture 6. Information protection infrastructure at the application and presentation layers
Plan:
1
📌 What is the OSI Model?�
Layer 7 – Application
👉 This is where users interact with the network.
How Data Moves (Encapsulation Idea)
What is the TCP/IP Model?�
Layers of TCP/IP Model�
2. Transport Layer�
3. Internet Layer�
�
4. Network Access (Link Layer)�
Working of TCP/IP Model�
4/10/2021
Security issues in application layer protocols
1. Using HTTP instead of HTTPS
🔴 Issue: If the app uses HTTP, the data is unencrypted and attackers could intercept it on the network.
2. DNS spoofing
🔴 Issue: If DNS is vulnerable, an attacker can alter the requested domain and redirect the user to a fraudulent website.
4. FTP vulnerability
🔴 Issue: FTP operates without encryption, which allows attackers to disrupt or modify the file transfer process. 5. Lack or weakness of API authentication
🔴 Issue: If the API works without authentication or with weak tokens, attackers can access it without permission.
What is identification?
Identification – is the process of determining the user who is entering the system. The user shows their identity through a login, email or another identifier.
🔹 Identification only determines who you are, but does not verify it (verification – is performed through authentication).🔹 For example, the user enters a login, but the system uses a password or other protective mechanisms to verify it.
Authenticating Users
Authentication – the process of a user proving their identity. It is implemented using the following methods:
✅ The user accesses the system with only one factor. ✅ For example: Accessing the system with only login and password. ❌ Less secure, because the password can be stolen or compromised.
2) Two-factor authentication
✅ The user is verified using two factors:1️⃣ Something you know (e.g., password) 2️⃣ Something you have
✅ For example:
Multi-factor authentication
✅ Higher protection than two-factor authentication. ✅ At least three different verification methods are used:�1️⃣ Password or PIN code�2️⃣ Code via SMS or mobile app�3️⃣ Fingerprint, facial recognition (Face ID) or USB-token (YubiKey)
User Management
User management – this is the process of organizing all users in the system, their roles and permissions.
1) User roles and permissions
🔹 Admin (Administrator) – Manages the system, has all permissions.🔹 User – Only has access to their own data.🔹 Moderator – Has the right to edit and manage certain data.🔹 Guest (Mehmon) – Has limited permissions only (e.g., view the site only).
✅ RBAC (Role-Based Access Control) – A role-based management system where each user is granted only the necessary permissions.
3. Organizing protected remote users
Core central requirements for remote operations
The remote system must have a secure connection and the data must be protected. The following requirements are necessary:
✅Complex authentication passwords�✅ Send over encrypted channels�✅ Maintain network security �✅ Restrict user rights �✅ View endpoint access capacity
Technologies for sharing remote issues
1) VPN (Virtual Private Network) – disable
VPN – a technology that provides encrypted and protected connections for remote users over a network.
🔹 Why is a VPN needed?
🔹VPN types:�✅ Site-to-Site VPN – Provides access for enterprises.�✅ Remote Access VPN – Provides access for remote users.�✅ S VPN – Grants SL VPN access via a browser.�✅
🔹 Popular VPN technologies:
Zero Trust Security Model – Concept of Untrusted Connection
Zero Trust – a model where users are given no trust no trust is granted and every authentication request is always enforced.
🔹 Zero Trust Use Cases:✅ "Never trust, always verify – Even a user within the organization also undergoes continuous verification.✅ Authenticate each session✅ Minimal permission – only has access rights to the necessary data access rights.✅ Effective authentication using TIV and context
🔹 Zero Trust operation mechanism:1️⃣ To securely access the system via multi-factor authentication proceeds. 2️⃣ Each request is checked by the E monitoring system is verified. 3️⃣ Data access depends on context (which device, which location, which time). 4️⃣ Continuous monitoring
Security firewall (Firewall) and IDS/IPS
Because it is connected via a remote network, it is very important for the network.
🔹 What is a Firewall?
🔹 What is IDS/IPS?✅ IDS (Intrusion Detection System) – Detects suspicious activity on the network and notifies the administrator. ✅ IPS (Intrusion Prevention System) – Blocks suspicious alerts and mitigates them.
Popular firewall and IDS/IPS systems:
Restricting Users' Rights (RBAC)
Remote users should be given only the necessary rights.
🔹 RBAC (Role-Based Access Control) – grant permissions to users based on their roles. �🔹 Least Privilege Access – users should only be able to access the necessary resources.
✅ Benefits of RBAC:
Application layer – Communication between humans and data transmission
4/10/2021
22
General risks
4/10/2021
23
Inherited vulnerabilities Secure Lower Layer Protocols; Application Encryption; Nonstandard Application
Authentication issues
Application layer protocols
Most parts of any type
does not support authentication
Both HTTP and, SMTP
also unauthenticated
Customers unauthenticated
allows connection to servers.
Direct connection to the system
Application layer protocols
operational
directly in the system
with applications
works correctly. Most
applications disks, files and
to execution
exists and also on this network
Command permissions are available.
SMTP protocol
4/10/2021
24
SMTP was developed not for the purpose of ensuring security, but to guarantee that messages are delivered reliably and in a timely manner. When the protocol was initially created, reliability was considered a more important issue than security. This viewpoint has led to a number of security risks that are not dependent on the implementation of MUA and MTA.
SMTP protocol risks fake subject and spam
4/10/2021
25
Fake email message
Fake email message is very
issues
may cause
can cause danger..
This
as
example organization
One can cite a manager's message about dismissing an organization employee from their position.
SPAM
Unwanted mail message (spam)
fake electronic messages
malicious purposes
for use example can be
can be. At first glance a message
legal entity by
appears as sent also,
actually completely another person
by sent will be.
MAIL logs
Electronic when forging electronic mail, servers listed in false headers are not saved in logs, the systems that sent the fake message
but it may store information about accounts for the real recipient.
Fake titled spam message
4/10/2021
26
HTTP protocol
4/10/2021
27
HTTP was developed as a flexible protocol for transmitting data in real time.
The initial specification of HTTP 1.0 was defined in RFC1945. Usually HTTP is used for transmitting HTML
although it is used (XML-based content and formatting specification), the protocol is not dependent on the content being transmitted. HTTP can easily transmit text or binary files, documents, or images.
GET / HTTP/1.0
Host: www.hackerfactor.com
HTTP/1.1 200 OK
Date: Sat, 21 Jan 2006 16:49:12 GMT Server: Apache/1.3.34
(Unix) mod_pointer/0.8 PHP/4.4.1
X-Powered-By: PHP/4.4.1 Connection: close Content-Type: text/html
<html>
<head><title>Hacker Factor Solutions</title></head> ...
</html>
www.hackerfactor.com site HTTP request (in black font) and its response
HTTP response status code classification
URL EXPLOITATION (Use/Exploitation)
4/10/2021
28
Hostname modification attack
1
3
5
4
2
Query misuse
(Query Abuse)
Cross-Site Scripting
Host and URL
masking
SQL Injections
Main risks of HTTP
4/10/2021
29
Unauthenticated client and server
1
3
5
4
2
Server address identification (Server Location Profiling)
Insecure applications (Insecure Applications)
Information loss (Information leakage)
Unauthorized access to the operating system
Unauthenticated client and server
HTTP on the server does not provide many options for authenticating the HTTP client. Although authentication is commonly used, it does not ensure the confidentiality of user personal data transmitted over the network. Because the data is transmitted in clear text, simple plain‑text data transmission makes authentication as vulnerable as in telnet and FTP. While SSH can be used instead of telnet and FTP, the slower connection speed of SSH does not allow it to replace HTTP.
Presentation layer
4/10/2021
30
To provide communication between network‑connected computers, application data must be converted into a language understandable by machines.
The presentation layer of the OSI model defines the functional capabilities of these conversions.
taqdimot sathi ushbu
o‘zgartirishlarning funksional imkoniyatlarini aniqlab beradi..
Presentation layer
Presentation layer
This layer manages syntax agreement and data transformation.
In addition, the presentation layer also controls the session layer by creating and terminating session requests.
seans sathini ham boshqaradi.
Presentation layer
4/10/2021
31
Encoding
Fake email message very
to
expose
can bring danger..
To
this
as
example
An example could be a manager’s message about dismissing an organization employee from their position.
Phishing
Unwanted email message
Fake electronic
for malicious purposes
can serve as an
It may appear
but in reality
Encryption
In email spoofing, servers mentioned in false headers are not stored in logs; the systems that sent the fake message
may keep information about accounts for the real recipient.
Elektron pochtani qalbakilashtirishda yolg‘on sarlavhalarda keltirilgan serverlar jurnallarda saqlanmaydi, qalbaki xabarni yuborgan tizimlar
esa haqiqiy qabul qiluvchi uchun akkauntlar haqida malumotni o‘zida saqlashi mumkin.
Thank you for your attention