To keep our communications secure on the web, we'd normally use HTTPS rather than HTTP. The S means that the communications are secure, and this is done by a protocol called the Transport Layer Security protocol or TLS. Before TLS, we used Secure Sockets Layer, SSL. Although many people still refer to SSL, it's outdated and it's been replaced with TLS. The job of TLS is to encrypt an application's data before it's sent and then to decrypt it before it's passed to the receiving application. Notice in the diagram, how TLS sits between the application layer protocols and the transport protocols. This means that TLS only encrypts the data portion of packets. Depending on the version of TLS being used, clients and servers will exchange information about how to encrypt the network data through an exchange of packets known as a handshake. For TLS version 1.2, this is likely to involve up to 10 packets but for TLS 1.3, the handshake will only require three to five packets. The handshake's used to negotiate a common encryption standard that's used by both ends. As we saw in the previous section of the course, TLS is not only used in web server communications. Many other protocols now use TLS to encrypt data. We've also seen how the HTTPS protocol is used by many applications, not just web servers, so a large proportion of communications on the internet are secured using TLS. SSL and TLS have gone through a series of versions where each one improves on the last. SSL 3.0 was deprecated in 2015, and organisations were advised to use TLS. So, TLS 1.2 and 1.3 are now the versions used on the internet, although systems are starting to move away from 1.2 to 1.3, which is more secure, and it's faster.

Another important technology that secures data transmission is IPsec. Although TLS is widely used, it's not supported by all applications and services. Also, because TLS only encrypts the data portion of packets, it doesn't protect against every type of network attack. IPsec protects entire packets, including the IP address headers. IPsec sits in the internet layer of the TCP/IP model, alongside IP. It adds its protection once an entire packet's been constructed, which makes it transparent to applications and services, therefore, it can be used to protect communications for almost anything, and as it's applying protection for an entire packet, IPsec protects the IP addresses, the port numbers and all of the various signalling data, such as the TCP sequence numbers. This means that IPsec protects against things like address spoofing and man in the middle attacks. Now, IPsec can work in modes to apply different forms of protection. With authenticating headers, IPsec calculates a digital signature for the entire packet. A digital signature is used to confirm that the contents of a packet haven't been modified in any way. Using authenticating headers doesn't encrypt the packet, so its contents could still be seen if it was intercepted. With Encapsulating Security Payload, or ESP for short, the entire packet gets encrypted. Now this means that routers can't see the IP information, so they can't route the packet and therefore, an extra IP section's added, which isn't encrypted, and then the entire new packet has a signature added by authenticating headers. But IPsec isn't finished here, another thing that it does is to add an authenticator to every packet. This means we can tell where the packet came from and confirm this.

The authenticator's used to accept or reject packets based on where they've come from. IPsec gives us a way to enable strong levels of security for network communications. Its name stands for IP Security, and it's an extension to the IP protocol. With IP version 4, IPsec's an add-on, but with IP version 6, it's actually part of the specification. Now, IPsec's gonna give many forms of protection. The encryption of ESP stops eavesdropping and theft of information from packets. The signatures allow any modifications made to packets when they're sent to be detected, and ESP stops them from being changed. This protects against packet modification and address spoofing attacks, and the packet authentication allows the receiver of packets to accept or block them based on the source, which is used to stop denial of service attacks. IPsec can be used with virtual private networks, and we'll look at this in the final section of the course. In this lab session, you're going to demonstrate how IPsec protects network communications. In Lab 18, you're going to be the attacker. You'll use Wireshark to capture the packets used to transfer a file between your lab computer and the server on the lab network. Remember that Windows uses a Server Message Block protocol to share files, while the latest versions of SMB support encryption, many businesses don't have this enabled, and this means that data could be stolen from the packets. You're gonna use Wireshark to extract the data from the packets and as you'll see, it can even reconstruct the file for you. In Lab 19, you're going to enable IPsec to protect the network communications.

While in this example, we could enable encryption for SMB, we don't know what other protocols are being used on the network, and enabling encryption on a protocol-by-protocol basis is complicated. You'll enable IPsec protection between your lab computer and the server, and this is done on Windows by creating connection security rules. You'll create some rules that tell the computers to request the use of IPsec whenever they can. Make sure that when you configure the policy, you choose request and not require. Once this is done, you'll then use Wireshark again to see if you can steal the data from the packets. Now, make sure that your lab computer is connected to the lab network for these exercises.

Module 3: Encryption part 2

About