Network security – how to prevent attacks & secure your server

Network and information security refers to the confidence that unauthorised users cannot access the information and services available on a network. Security implies safety. It assumes data integrity, freedom from unauthorised access of resources and freedom from disruption of services. 
As far as security is concerned, we need to protect both physical and abstract resources, such as information. Protecting the latter is more difficult.
Information security is concerned with three main areas: confidentiality (information should be available only to those who rightfully have access to it), 
integrity (information should be modified only by those who are authorised to do so) and availability (information should be accessible to those who need it when they need it).

Authentication attack
On the internet, where data passes across intermediate routers and networks, source authentication can be easily attacked at one of the intermediate routers. For example, an impostor can gain control of a router, ‘R’, that lies between a valid client and a server. He can then alter the routes in R to direct return traffic to him and generate a request using the authorised client’s address as a source address. The server will, in this case, accept the request and send the reply to the authorized client. When it reaches R, the reply will be forwarded along the incorrect route to the impostor.

The above example illustrates the need for the server and client to not communicate with impostors. One way of ensuring this is to use the authentication mechanism (also known as IP address authentication). This is a simple security mechanism to verify identification. Here, a server is configured with a list of valid IP source addresses. And when a request arrives, the server makes sure that it’s from a valid client by matching the client’s IP address with the ones in the configured list. Only if the client is authorised does the server grant it the service requested for.

Another method is the public-key encryption mechanism. In this case, we will be using a pair of keys: a public key and a private key. The sender using the public key of the receiver will encrypt the message and when the receiver receives it, he decrypts it using his private key (which only he knows). Thus the sender can make sure that only the intended receiver will receive the message. The public key encryption can be used for authentication, confidentiality and integrity of the messages.

 

Securing Insecure Wireless Networks

Wireless networks are easy to set up—especially if they're insecure. Your office may have a wireless network that's locked down with WPA or WPA2 encryption and Radius authentication servers; if you work from home or in a public area on an insecure wireless network, you might expose sensitive information. What kinds of threats are out there

 

 

Without security measures and controls in place, your data might be subjected to an attack. Some attacks are passive, meaning information is monitored; others are active, meaning the information is altered with intent to corrupt or destroy the data or the network itself.

Your networks and data are vulnerable to any of the following types of attacks if you do not have a security plan in place.

                                                         

Some type of network attack are :-

-Passive attack

•  Monitors unencrypted traffic and looks for clear-text passwords and sensitive information 

-Active attack

• Attacker tries to bypass or break into secured systems
• This can be done through stealth, viruses, worms, or Trojan horses.
• Active attacks result in the disclosure or dissemination of data files, DoS, or modification of data. 

                                                            




-Phishing attack

• In phishing attack the hacker creates a fake web site that looks exactly like a popular site such as the SBI bank or paypal.
• The hacker then sends an e-mail message trying to trick the user into clicking a link that leads to the fake site. 
• When the user attempts to log on with their account information, the hacker records the username and password and then tries that information on the real site. 

• Some phishing site are :-

 1.Google                                       2.Paypal

                                                                                    
 



 3.Facebook                                       4. Gmail

                                        




-Password attack

• An attacker tries to crack the passwords stored in a network account database or a password-protected file.
• There are three major types of password attacks: a dictionary attack, a brute-force attack, and a hybrid attack.