Network Security: Firewalls, VPNs & TLS Revision

1. The Foundation: The CIA Triad

Confidentiality: Ensuring data is accessible only by authorized users (e.g., Encryption).
Integrity: Ensuring data remains accurate and unaltered during transit (e.g., Hashing/Checksums).
Availability: Ensuring resources are reliably accessible when needed (e.g., Redundancy, DDoS mitigation).

Stateful Firewalls: The modern standard. They maintain a State Table to track active connections. If an internal user requests a website, the firewall remembers that outgoing request and automatically allows the incoming response through.
Zone-Based Firewalls: Instead of rules tied to physical interfaces, interfaces are grouped into Security Zones (e.g., Inside, Outside, DMZ). Policies are applied to traffic moving between these zones (e.g., Inside $\rightarrow$ Outside = Allow; Outside $\rightarrow$ Inside = Deny).
DMZ (Demilitarized Zone): A buffer subnetwork that exposes external-facing services (like Web/Mail servers) to the public, while keeping the internal network shielded behind a second layer of firewall protection.

Purpose: To create a secure, encrypted tunnel over an untrusted network (the Internet).
IPSec Tunnel Mode: Encrypts the entire packet (payload + original header) and wraps it in a new outer IP header. This is the industry standard for secure site-to-site VPNs.
SSL/TLS VPN: Generally used for remote-access (user-to-site). It uses standard browser-based encryption (Port 443) to secure the connection, requiring less specialized client software.

IDS (Intrusion Detection System): The “Security Camera.” It monitors a copy of the traffic (often via a SPAN/Mirror port), analyzes it for signatures of known attacks, and alerts admins. It cannot stop the traffic.
IPS (Intrusion Prevention System): The “Security Guard.” It sits inline (all traffic must pass through it). It identifies malicious traffic in real time and can drop packets instantly to prevent the attack from reaching the target.

DoS vs. DDoS:
DoS: A single attacker floods a target.
DDoS: Orchestrated botnets (thousands of compromised devices) flood a target simultaneously, making blocking individual IPs ineffective.
ARP Poisoning (MitM): An attacker sends fake ARP replies to associate their MAC address with the Default Gateway’s IP, redirecting traffic through their device. Mitigation: Use Dynamic ARP Inspection (DAI) on switches.
Rogue DHCP: Unauthorized devices handing out false IP configurations. Mitigation: Use DHCP Snooping on switches to block unauthorized DHCP offers.

If asked how to host a secure web server:

Place the server in a DMZ: Never put a public-facing web server on your internal trusted network.
Strict Firewall Rules: Allow Outside $\rightarrow$ DMZ only on ports 80/443.
Strict Internal Rules: Allow DMZ $\rightarrow$ Internal Database only on the specific SQL port (e.g., 3306), and deny all traffic from the DMZ to the rest of the internal network.

Symmetric encryption: one shared key for both encrypt and decrypt (AES, DES, 3DES). Fast, but key distribution is hard — both sides must share the secret securely.
Asymmetric encryption: a public/private key pair. Encrypt with the public key, decrypt with the private key (RSA, ECC). Slower, but solves key exchange — no need to share a secret.
Hybrid (what TLS actually does): use asymmetric to safely exchange a symmetric session key, then use fast symmetric AES for the bulk data.
Hashing (not encryption): one-way, no key. Used for integrity (SHA-256) and passwords. Can’t be reversed.

Client Hello: client sends supported TLS versions + cipher suites.
Server Hello + Certificate: server picks a cipher and sends its digital certificate (public key + identity).
Key Exchange: client verifies the certificate, then securely derives a shared session key (via asymmetric crypto).
Finished (encrypted): both sides switch to the symmetric session key and confirm — a secure, encrypted channel is established.

HTTPS = HTTP over TLS. The padlock means the session key was exchanged and the connection is encrypted + authenticated.

DoS/DDoS: overwhelm a target. Mitigate with rate limiting, CDNs, DDoS protection, load balancers.
ARP poisoning / MAC flooding: attacker impersonates a host or floods the switch CAM table. Mitigate with DAI (Dynamic ARP Inspection) and port security.
Rogue DHCP: a fake DHCP server hands out malicious IPs. Mitigate with DHCP snooping (trusted vs untrusted ports).
IP spoofing: forging source IPs. Mitigate with ingress filtering and authentication.
XSS / SQL injection / session hijacking: application-layer attacks — validate/sanitize input, parameterize queries, use secure session cookies (HttpOnly, Secure).