1 1 00:00:00,370 --> 00:00:01,970 The CIA Triad. 2 2 00:00:01,970 --> 00:00:05,320 In this lesson, we're going to talk about the CIA Triad. 3 3 00:00:05,320 --> 00:00:07,330 Now this is important because by default, 4 4 00:00:07,330 --> 00:00:10,130 our networks are fundamentally not secure. 5 5 00:00:10,130 --> 00:00:11,580 When they were developed and all these different 6 6 00:00:11,580 --> 00:00:13,860 networking standards were created many years ago, 7 7 00:00:13,860 --> 00:00:16,230 security was not in the discussion. 8 8 00:00:16,230 --> 00:00:17,490 Instead, over the years, 9 9 00:00:17,490 --> 00:00:20,190 we've tried to bolt on and add on security as we go, 10 10 00:00:20,190 --> 00:00:22,520 to make these networking protocols more secure. 11 11 00:00:22,520 --> 00:00:26,170 But to begin with, a network is a very unsecure place. 12 12 00:00:26,170 --> 00:00:28,380 To make matters worse, networks are increasingly 13 13 00:00:28,380 --> 00:00:30,950 becoming more connected with other networks. 14 14 00:00:30,950 --> 00:00:33,660 If my company begins to do a partnership with your company, 15 15 00:00:33,660 --> 00:00:36,400 we may decide to tie our networks together during that time. 16 16 00:00:36,400 --> 00:00:39,340 And this introduces all sorts of risks and vulnerabilities 17 17 00:00:39,340 --> 00:00:42,120 from your network into my network and vice versa. 18 18 00:00:42,120 --> 00:00:44,030 So we have to be aware of this. 19 19 00:00:44,030 --> 00:00:46,160 These risks don't just exist between business partners 20 20 00:00:46,160 --> 00:00:47,910 or between different people on the internet, 21 21 00:00:47,910 --> 00:00:50,690 but they also exist within our own organizations. 22 22 00:00:50,690 --> 00:00:53,120 Your organization may have numerous sub networks, 23 23 00:00:53,120 --> 00:00:54,780 and when you tie them all together, 24 24 00:00:54,780 --> 00:00:57,910 that's going to start bringing other risks into your networks. 25 25 00:00:57,910 --> 00:01:00,300 We have to be careful to in order to minimize and eliminate 26 26 00:01:00,300 --> 00:01:02,830 these risks over time, and that's where network security 27 27 00:01:02,830 --> 00:01:04,370 is going to come into play. 28 28 00:01:04,370 --> 00:01:06,540 If we can understand the various threats that are facing our 29 29 00:01:06,540 --> 00:01:08,320 networks, then we're going to be better able 30 30 00:01:08,320 --> 00:01:10,390 to defend our networks against the onslaught 31 31 00:01:10,390 --> 00:01:13,770 of cyber attacks that we are facing on a daily basis. 32 32 00:01:13,770 --> 00:01:15,500 The way we look at security in our networks 33 33 00:01:15,500 --> 00:01:18,270 is based on something called the CIA Triad. 34 34 00:01:18,270 --> 00:01:19,870 Now this stands for Confidentiality, 35 35 00:01:19,870 --> 00:01:21,690 Integrity and Availability. 36 36 00:01:21,690 --> 00:01:24,470 Those are the three tenants that make up this Triad 37 37 00:01:24,470 --> 00:01:25,800 that give us security. 38 38 00:01:25,800 --> 00:01:27,960 Now when I can provide all three of these things, 39 39 00:01:27,960 --> 00:01:31,290 I can secure the data inside the center of this triangle. 40 40 00:01:31,290 --> 00:01:33,640 Now this sounds really, really easy, but in reality, 41 41 00:01:33,640 --> 00:01:35,260 it's really, really hard. 42 42 00:01:35,260 --> 00:01:37,220 We're going to talk more about these three components 43 43 00:01:37,220 --> 00:01:39,770 of the CIA Triad in this lesson. 44 44 00:01:39,770 --> 00:01:42,620 Our first one is C, for Confidentiality. 45 45 00:01:42,620 --> 00:01:44,180 Now confidentiality is concerned 46 46 00:01:44,180 --> 00:01:46,540 with keeping your data safe and private. 47 47 00:01:46,540 --> 00:01:49,100 We want to use things like encryption and authentication 48 48 00:01:49,100 --> 00:01:51,220 to verify that somebody has the need to know 49 49 00:01:51,220 --> 00:01:53,770 and that they should be allowed to see that data. 50 50 00:01:53,770 --> 00:01:55,940 By using encryption, we can ensure that that data 51 51 00:01:55,940 --> 00:01:59,030 can only be read or decoded by the intended recipient, 52 52 00:01:59,030 --> 00:02:01,240 and that person is going to have a secret encryption 53 53 00:02:01,240 --> 00:02:03,640 or decryption key to be able to read it. 54 54 00:02:03,640 --> 00:02:06,050 Now to do this, we can use either symmetric encryption 55 55 00:02:06,050 --> 00:02:07,800 or asymmetric encryption. 56 56 00:02:07,800 --> 00:02:09,500 Now if you're not familiar with those concepts, 57 57 00:02:09,500 --> 00:02:10,900 we're going to cover them here for you 58 58 00:02:10,900 --> 00:02:12,350 to bring you up to speed. 59 59 00:02:12,350 --> 00:02:14,480 Symmetric encryption is something that is the basis 60 60 00:02:14,480 --> 00:02:15,900 of confidentiality. 61 61 00:02:15,900 --> 00:02:17,960 Both the sender and the receiver are going to use 62 62 00:02:17,960 --> 00:02:19,340 the exact same key, 63 63 00:02:19,340 --> 00:02:21,330 which is why we call it symmetric encryption 64 64 00:02:21,330 --> 00:02:23,240 or symmetric key cryptography. 65 65 00:02:23,240 --> 00:02:26,400 Now we can go from plain text to ciphertext using one key, 66 66 00:02:26,400 --> 00:02:28,210 and then the other person who wants to read it, 67 67 00:02:28,210 --> 00:02:30,920 will use that same key to decrypt it from ciphertext 68 68 00:02:30,920 --> 00:02:32,150 back into plain text, 69 69 00:02:32,150 --> 00:02:34,370 so they can actually read it in normal language. 70 70 00:02:34,370 --> 00:02:35,640 Now there are several different types 71 71 00:02:35,640 --> 00:02:37,280 of symmetric encryptions out there, 72 72 00:02:37,280 --> 00:02:39,050 but in the case of the Network+ exam, 73 73 00:02:39,050 --> 00:02:41,300 we only really need to focus on three of them. 74 74 00:02:41,300 --> 00:02:43,173 This is DES, Triple DES and AES. 75 75 00:02:44,380 --> 00:02:46,010 The first of these is DES. 76 76 00:02:46,010 --> 00:02:48,120 Now DES is the Data Encryption Standard, 77 77 00:02:48,120 --> 00:02:51,400 and it uses a 56-bit encryption key to secure its data, 78 78 00:02:51,400 --> 00:02:53,210 using symmetric encryption. 79 79 00:02:53,210 --> 00:02:54,840 DES was actually developed all the way back 80 80 00:02:54,840 --> 00:02:56,540 in the mid 1970s. 81 81 00:02:56,540 --> 00:02:59,550 Now that's about 40 years ago, so as you can imagine, 82 82 00:02:59,550 --> 00:03:01,100 it's not really that secure, 83 83 00:03:01,100 --> 00:03:04,420 but yet we still use it today in things like SNMP, 84 84 00:03:04,420 --> 00:03:07,140 the Simple Network Management Protocol version 3. 85 85 00:03:07,140 --> 00:03:09,640 DES is considered a weak encryption algorithm today, 86 86 00:03:09,640 --> 00:03:11,680 but it is still better than having nothing, 87 87 00:03:11,680 --> 00:03:14,420 which is what we had in earlier versions of SNMP. 88 88 00:03:14,420 --> 00:03:15,990 Next, we have Triple DES, 89 89 00:03:15,990 --> 00:03:18,190 and this was because DES was becoming insecure 90 90 00:03:18,190 --> 00:03:19,950 because of this 56-bit key. 91 91 00:03:19,950 --> 00:03:21,580 It was starting to become very easy to crack 92 92 00:03:21,580 --> 00:03:23,840 as computers got smarter and faster. 93 93 00:03:23,840 --> 00:03:26,080 So, as these computers got stronger, 94 94 00:03:26,080 --> 00:03:28,250 they decided we need to have better encryption. 95 95 00:03:28,250 --> 00:03:31,410 So they decided to take something, encrypt it with one key, 96 96 00:03:31,410 --> 00:03:33,880 decrypt it, and then re-encrypt it again. 97 97 00:03:33,880 --> 00:03:37,040 And each of those portions would use a different 56-bit key. 98 98 00:03:37,040 --> 00:03:38,520 So we used DES to encrypt it, 99 99 00:03:38,520 --> 00:03:40,730 then we decrypt it with a different key, 100 100 00:03:40,730 --> 00:03:41,790 scrambling it further, 101 101 00:03:41,790 --> 00:03:44,340 and then re-encrypt it a third time with a different key, 102 102 00:03:44,340 --> 00:03:45,810 scrambling it even more. 103 103 00:03:45,810 --> 00:03:47,590 This means that we get a total key strength 104 104 00:03:47,590 --> 00:03:49,540 of about 168-bits, 105 105 00:03:49,540 --> 00:03:52,210 because we're doing this encrypt decrypt encrypt cycle 106 106 00:03:52,210 --> 00:03:54,860 using three different keys, and that makes our data totally 107 107 00:03:54,860 --> 00:03:56,910 unreadable or ineligible for anyone 108 108 00:03:56,910 --> 00:03:59,530 who doesn't have all of those three keys. 109 109 00:03:59,530 --> 00:04:03,150 Finally, we have AES, or the Advanced Encryption Standard. 110 110 00:04:03,150 --> 00:04:05,360 This is the modern contemporary encryption system 111 111 00:04:05,360 --> 00:04:07,810 that we use on pretty much everything these days. 112 112 00:04:07,810 --> 00:04:09,850 This is the preferred symmetric key encryption 113 113 00:04:09,850 --> 00:04:12,020 that we're going to use in any network today, 114 114 00:04:12,020 --> 00:04:14,550 and it's also use by default in WPA2 115 115 00:04:14,550 --> 00:04:16,090 for securing our wireless networks, 116 116 00:04:16,090 --> 00:04:18,370 as well as BitLocker for encrypting our hard drives 117 117 00:04:18,370 --> 00:04:20,160 to provide us data at rest. 118 118 00:04:20,160 --> 00:04:22,480 AES, or the Advanced Encryption Standard, 119 119 00:04:22,480 --> 00:04:25,160 is going to use three different size encryption keys. 120 120 00:04:25,160 --> 00:04:29,920 It can use 128-bit key, a 192-bit key or 256-bit key 121 121 00:04:29,920 --> 00:04:31,650 making it very secure. 122 122 00:04:31,650 --> 00:04:33,570 Now when we look at symmetric encryption, 123 123 00:04:33,570 --> 00:04:36,410 the sender and the receiver are both using the same key 124 124 00:04:36,410 --> 00:04:38,300 to encrypt and decrypt it, which is great, 125 125 00:04:38,300 --> 00:04:40,270 and it makes it extremely fast. 126 126 00:04:40,270 --> 00:04:43,750 In fact, symmetric encryption is almost 1000 times faster 127 127 00:04:43,750 --> 00:04:45,480 than using asymmetric encryption, 128 128 00:04:45,480 --> 00:04:47,100 where we use two different keys. 129 129 00:04:47,100 --> 00:04:48,670 Now we're going to cover asymmetric encryption 130 130 00:04:48,670 --> 00:04:49,740 in just a second, 131 131 00:04:49,740 --> 00:04:51,520 but first we need to talk about some problems 132 132 00:04:51,520 --> 00:04:52,930 with symmetric encryption. 133 133 00:04:52,930 --> 00:04:54,350 Now there is one large problem 134 134 00:04:54,350 --> 00:04:55,770 with symmetric encryption though. 135 135 00:04:55,770 --> 00:04:58,160 And this is that we both have to have the same key 136 136 00:04:58,160 --> 00:05:00,120 to encrypt and decrypt that data. 137 137 00:05:00,120 --> 00:05:01,820 Now if you and I have never met before, 138 138 00:05:01,820 --> 00:05:04,760 how are we going to make sure we both have the same shared key? 139 139 00:05:04,760 --> 00:05:06,520 Well, if I'm doing this on a large scale, 140 140 00:05:06,520 --> 00:05:08,470 let's say I encrypted a folder on my Google Drive 141 141 00:05:08,470 --> 00:05:10,130 that I wanted to share with all of my students, 142 142 00:05:10,130 --> 00:05:13,040 I would have 300,000 people who need to access 143 143 00:05:13,040 --> 00:05:13,950 that Google Drive, 144 144 00:05:13,950 --> 00:05:16,290 and I have to get each of them a copy of that key, 145 145 00:05:16,290 --> 00:05:19,190 that'd be a really hard task to do and to do it securely. 146 146 00:05:19,190 --> 00:05:21,280 Now, let's imagine that one of those students 147 147 00:05:21,280 --> 00:05:22,790 shouldn't have access anymore. 148 148 00:05:22,790 --> 00:05:24,460 Now I have to go and change that key and give it 149 149 00:05:24,460 --> 00:05:28,830 to the other 299,999 people who still need access. 150 150 00:05:28,830 --> 00:05:31,310 And I have to have a secure way to redistribute that new key 151 151 00:05:31,310 --> 00:05:33,790 to all of those people who still need to access it. 152 152 00:05:33,790 --> 00:05:35,210 You see, this is the biggest problem 153 153 00:05:35,210 --> 00:05:36,680 we have with symmetric encryption. 154 154 00:05:36,680 --> 00:05:38,140 It's key management. 155 155 00:05:38,140 --> 00:05:40,160 Even though symmetric encryption is fast, 156 156 00:05:40,160 --> 00:05:41,360 and even though it's secure, 157 157 00:05:41,360 --> 00:05:43,640 we still have to figure out a way to get a secured 158 158 00:05:43,640 --> 00:05:46,980 share secret key to all the users who need to use it. 159 159 00:05:46,980 --> 00:05:49,050 So, how are we going to solve that problem? 160 160 00:05:49,050 --> 00:05:51,870 Well, enter the world of asymmetric encryption. 161 161 00:05:51,870 --> 00:05:54,730 Now asymmetric encryption is used to give confidentiality 162 162 00:05:54,730 --> 00:05:57,890 as well, but it does this by using two different keys, 163 163 00:05:57,890 --> 00:06:00,320 one for the sender and one for the receiver. 164 164 00:06:00,320 --> 00:06:03,450 Now, RSA is by far the most popular implementation of this, 165 165 00:06:03,450 --> 00:06:07,300 and it uses what we call Public Key Infrastructure, or PKI. 166 166 00:06:07,300 --> 00:06:10,210 Now PKI is where we encrypt the data between an email sender 167 167 00:06:10,210 --> 00:06:11,410 and an email receiver, 168 168 00:06:11,410 --> 00:06:14,120 or when you're going to an E-commerce site like Amazon, 169 169 00:06:14,120 --> 00:06:16,920 you're going to be using PKI to do a key exchange. 170 170 00:06:16,920 --> 00:06:19,440 This way, you can get a secure email exchange 171 171 00:06:19,440 --> 00:06:20,700 or secure web browsing, 172 172 00:06:20,700 --> 00:06:22,840 and it solves the problem of having to distribute those keys 173 173 00:06:22,840 --> 00:06:25,670 ahead of time because we're using public keys. 174 174 00:06:25,670 --> 00:06:28,480 So how does asymmetric encryption work? 175 175 00:06:28,480 --> 00:06:31,410 Well, it works on the concept of having a Key Pair. 176 176 00:06:31,410 --> 00:06:34,080 This key pair is made up of a Public and a Private key. 177 177 00:06:34,080 --> 00:06:35,760 The Public Key, anybody can know, 178 178 00:06:35,760 --> 00:06:37,870 and we can share with everyone in the entire world, 179 179 00:06:37,870 --> 00:06:40,720 but the Private Key is something that only I should know 180 180 00:06:40,720 --> 00:06:42,390 and nobody else should see it. 181 181 00:06:42,390 --> 00:06:44,410 Let's see how this works in the real world. 182 182 00:06:44,410 --> 00:06:46,710 Well, when we look at this, there's a sender and receiver 183 183 00:06:46,710 --> 00:06:49,130 and they're both going to use different keys to encrypt 184 184 00:06:49,130 --> 00:06:50,480 and decrypt the message. 185 185 00:06:50,480 --> 00:06:52,060 In this case, if I'm the sender, 186 186 00:06:52,060 --> 00:06:53,840 and I want to send something to the receiver, 187 187 00:06:53,840 --> 00:06:55,540 I'm going to use the receiver's public key, 188 188 00:06:55,540 --> 00:06:58,600 which everyone in the world can know because it's public. 189 189 00:06:58,600 --> 00:07:01,330 Now, once I've encrypted that data using their public key, 190 190 00:07:01,330 --> 00:07:03,900 the only key in the entire world that can open up that 191 191 00:07:03,900 --> 00:07:07,240 message and decrypt, is going to be their private key. 192 192 00:07:07,240 --> 00:07:10,100 And the only person with that private key is that receiver. 193 193 00:07:10,100 --> 00:07:11,860 So we know it has confidentiality 194 194 00:07:11,860 --> 00:07:14,070 'cause only they can decrypt this message. 195 195 00:07:14,070 --> 00:07:15,930 This guarantees that we're going to have confidentiality 196 196 00:07:15,930 --> 00:07:18,170 of the data because nobody can read it except them, 197 197 00:07:18,170 --> 00:07:21,270 and once I encrypt that data, even I can't read it 198 198 00:07:21,270 --> 00:07:23,850 because I don't have the receiver's private key. 199 199 00:07:23,850 --> 00:07:25,840 So how does this work if we're going to use 200 200 00:07:25,840 --> 00:07:27,150 E-commerce for instance? 201 201 00:07:27,150 --> 00:07:29,680 Well, I said before that we can use asymmetric keys 202 202 00:07:29,680 --> 00:07:31,450 as a way to do a key exchange. 203 203 00:07:31,450 --> 00:07:33,530 And we're going to be able to share a symmetric key 204 204 00:07:33,530 --> 00:07:36,240 through that by creating an encrypted tunnel. 205 205 00:07:36,240 --> 00:07:38,470 So, what we're going to do here in E-commerce 206 206 00:07:38,470 --> 00:07:41,660 is using asymmetric to then turn over to symmetric. 207 207 00:07:41,660 --> 00:07:43,610 In this case, if I wanted to be the client 208 208 00:07:43,610 --> 00:07:45,660 and I wanted to go to Amazon to buy something, 209 209 00:07:45,660 --> 00:07:46,770 I would do it this way. 210 210 00:07:46,770 --> 00:07:50,260 First, I'm going to request the website by going to amazon.com, 211 211 00:07:50,260 --> 00:07:52,250 and I'm going to use the secure version of the website 212 212 00:07:52,250 --> 00:07:56,340 by going to https://amazon.com. 213 213 00:07:56,340 --> 00:07:58,860 Now when I go to that server, the server is going to tell me 214 214 00:07:58,860 --> 00:08:00,760 that it has a public key available. 215 215 00:08:00,760 --> 00:08:02,950 That public key is going to have what we like to call 216 216 00:08:02,950 --> 00:08:04,600 a Digital Certificate. 217 217 00:08:04,600 --> 00:08:06,860 Now when you buy a VeriSign Certificate, 218 218 00:08:06,860 --> 00:08:09,750 or some other trusted certificate for your server, 219 219 00:08:09,750 --> 00:08:12,660 that server is going to then hold a copy of your public key 220 220 00:08:12,660 --> 00:08:15,670 for you and any client who wants to get it can go to that 221 221 00:08:15,670 --> 00:08:18,460 trusted third party and get a copy of your public key. 222 222 00:08:18,460 --> 00:08:21,180 So, my web client is going to go to VeriSign, 223 223 00:08:21,180 --> 00:08:22,960 it's going to grab Amazon's public key, 224 224 00:08:22,960 --> 00:08:25,350 and then I'm going to create a random number 225 225 00:08:25,350 --> 00:08:26,440 and whatever I'm going to choose, 226 226 00:08:26,440 --> 00:08:28,360 and I'm going to encrypt that random number using 227 227 00:08:28,360 --> 00:08:30,570 the public key that Amazon has. 228 228 00:08:30,570 --> 00:08:33,270 Now, I'm going to send that back over to the Amazon Server 229 229 00:08:33,270 --> 00:08:36,070 because Amazon will be the only person who can unlock 230 230 00:08:36,070 --> 00:08:38,870 that message and decrypt it using their private key, 231 231 00:08:38,870 --> 00:08:40,640 which is part of their server code, 232 232 00:08:40,640 --> 00:08:43,700 now they can open that message and see that random number. 233 233 00:08:43,700 --> 00:08:45,940 So, now that they have the random number I chose, 234 234 00:08:45,940 --> 00:08:47,390 I know it because I chose it, 235 235 00:08:47,390 --> 00:08:49,700 and they know it because they decrypted the message. 236 236 00:08:49,700 --> 00:08:52,400 So, we've used a asymmetric encryption to be able 237 237 00:08:52,400 --> 00:08:53,970 to pass this random number, 238 238 00:08:53,970 --> 00:08:56,290 which will now act as our symmetric key. 239 239 00:08:56,290 --> 00:08:58,990 Now, we can both create a tunnel and that tunnel can be 240 240 00:08:58,990 --> 00:09:01,610 secured by that symmetric key we just chose, 241 241 00:09:01,610 --> 00:09:03,940 and we can use that for the entire session. 242 242 00:09:03,940 --> 00:09:05,890 This becomes known as a session key, 243 243 00:09:05,890 --> 00:09:08,360 which is a simply that random number that I chose 244 244 00:09:08,360 --> 00:09:09,730 and sent over to Amazon. 245 245 00:09:09,730 --> 00:09:12,710 Now we can communicate securely for the rest of the session, 246 246 00:09:12,710 --> 00:09:14,380 creating a nice secure encrypted tunnel 247 247 00:09:14,380 --> 00:09:16,490 between me and the Amazon Server. 248 248 00:09:16,490 --> 00:09:18,150 Now, why would I do it this way? 249 249 00:09:18,150 --> 00:09:20,770 Why wouldn't I just use an asymmetric key the entire time 250 250 00:09:20,770 --> 00:09:22,340 and send data back and forth? 251 251 00:09:22,340 --> 00:09:25,530 Well, the problem is, asymmetric is pretty slow. 252 252 00:09:25,530 --> 00:09:28,460 In fact, symmetric key is a thousand times faster 253 253 00:09:28,460 --> 00:09:29,430 than asymmetric. 254 254 00:09:29,430 --> 00:09:32,720 So, we want to use symmetric to the maximum extent possible, 255 255 00:09:32,720 --> 00:09:35,150 but there's some things that symmetric doesn't do well 256 256 00:09:35,150 --> 00:09:36,410 like a key exchange. 257 257 00:09:36,410 --> 00:09:39,220 So, for that reason, we're going to use asymmetric 258 258 00:09:39,220 --> 00:09:41,390 to do the handshake and exchange a key, 259 259 00:09:41,390 --> 00:09:43,300 and then we're going to switch over to symmetric 260 260 00:09:43,300 --> 00:09:46,250 using that key we just exchanged to get those faster speeds 261 261 00:09:46,250 --> 00:09:48,570 for all the rest of our data transfer. 262 262 00:09:48,570 --> 00:09:50,310 All right, the next thing we to talk about 263 263 00:09:50,310 --> 00:09:52,310 is the I in the CIA Triad. 264 264 00:09:52,310 --> 00:09:53,840 This is Integrity. 265 265 00:09:53,840 --> 00:09:56,210 Now Integrity is all about making sure that the data you 266 266 00:09:56,210 --> 00:09:59,380 have was not modified in storage or in transit. 267 267 00:09:59,380 --> 00:10:01,220 This verifies that the source of the traffic 268 268 00:10:01,220 --> 00:10:04,340 that it originated from, was where you thought it came from. 269 269 00:10:04,340 --> 00:10:05,940 We're not going to be subject to an on-path 270 270 00:10:05,940 --> 00:10:07,410 or man in the middle attack here, 271 271 00:10:07,410 --> 00:10:10,770 because we want to make sure that that data has integrity. 272 272 00:10:10,770 --> 00:10:12,940 Also, this will help us prevent forms of spoofing 273 273 00:10:12,940 --> 00:10:16,100 like IP spoofing, ARP spoofing or Mac spoofing. 274 274 00:10:16,100 --> 00:10:19,150 Integrity violations can also happen if there's a defacement 275 275 00:10:19,150 --> 00:10:20,730 of your corporate webpage for example, 276 276 00:10:20,730 --> 00:10:23,170 because somebody is changing the data on your server 277 277 00:10:23,170 --> 00:10:24,730 and you didn't authorize it. 278 278 00:10:24,730 --> 00:10:27,410 All these are examples of integrity violations. 279 279 00:10:27,410 --> 00:10:28,610 Now another example of this would be 280 280 00:10:28,610 --> 00:10:30,310 if somebody went to your E-commerce site, 281 281 00:10:30,310 --> 00:10:31,890 and they'd like to buy a product that's supposed to sell 282 282 00:10:31,890 --> 00:10:34,640 for a 100 dollars, but they actually changed that 283 283 00:10:34,640 --> 00:10:36,790 to 10 dollars by removing a zero. 284 284 00:10:36,790 --> 00:10:39,350 That will be an integrity breach because they also modified 285 285 00:10:39,350 --> 00:10:42,150 the electronically stored financial records on your server. 286 286 00:10:42,150 --> 00:10:44,250 So, what if I decided to add a couple of zeros 287 287 00:10:44,250 --> 00:10:45,570 to my bank account balance? 288 288 00:10:45,570 --> 00:10:47,830 Guess what, that's also an integrity breach 289 289 00:10:47,830 --> 00:10:48,940 because I'm changing the balance 290 290 00:10:48,940 --> 00:10:50,830 and I'm not authorized to do that. 291 291 00:10:50,830 --> 00:10:52,970 All these things are things that we don't want to happen 292 292 00:10:52,970 --> 00:10:54,420 inside of our network. 293 293 00:10:54,420 --> 00:10:57,420 So, how do we ensure that we have integrity? 294 294 00:10:57,420 --> 00:10:59,390 Well, we're going to use Hashing. 295 295 00:10:59,390 --> 00:11:01,720 Now Hashing is an algorithm that runs a string of data 296 296 00:11:01,720 --> 00:11:02,750 through the algorithm, 297 297 00:11:02,750 --> 00:11:05,520 and then it creates a hash or a hash digest. 298 298 00:11:05,520 --> 00:11:08,420 This serves as a unique individual fingerprint for a file 299 299 00:11:08,420 --> 00:11:09,640 or a data set. 300 300 00:11:09,640 --> 00:11:11,130 All right, if you see here on the screen, 301 301 00:11:11,130 --> 00:11:13,810 I have the word password written in three different ways. 302 302 00:11:13,810 --> 00:11:15,100 I have it written as password, 303 303 00:11:15,100 --> 00:11:17,030 I have it written as password with a capital P, 304 304 00:11:17,030 --> 00:11:18,770 and I have it written as password with a capital P 305 305 00:11:18,770 --> 00:11:20,210 and a period at the end. 306 306 00:11:20,210 --> 00:11:22,950 Notice, those three hashes are vastly different, 307 307 00:11:22,950 --> 00:11:24,650 even though I changed very little, 308 308 00:11:24,650 --> 00:11:26,500 just adding a period or changing a letter 309 309 00:11:26,500 --> 00:11:28,130 from lowercase to uppercase. 310 310 00:11:28,130 --> 00:11:31,360 In this example, I'm using an MD5 hash for each one of these 311 311 00:11:31,360 --> 00:11:34,170 and this algorithm ensures drastic changes to the output, 312 312 00:11:34,170 --> 00:11:36,470 when a slight change is made to the input. 313 313 00:11:36,470 --> 00:11:38,870 Now, by just adding that period or making a capital letter 314 314 00:11:38,870 --> 00:11:40,180 instead of a lowercase letter, 315 315 00:11:40,180 --> 00:11:43,440 we have this huge amount of change to the hash digest. 316 316 00:11:43,440 --> 00:11:46,080 That's how we're using them as individual fingerprints. 317 317 00:11:46,080 --> 00:11:48,230 Once I run this data through the algorithm, 318 318 00:11:48,230 --> 00:11:50,500 I get this hash, and the data and the hash 319 319 00:11:50,500 --> 00:11:52,480 are then going to be sent over to the receiver. 320 320 00:11:52,480 --> 00:11:54,030 Now when the receiver gets the data, 321 321 00:11:54,030 --> 00:11:56,480 they're going to run it through the same hash on their own side 322 322 00:11:56,480 --> 00:11:59,740 and compare that hash they get to the hash that I sent them. 323 323 00:11:59,740 --> 00:12:01,210 If the two are going to match, 324 324 00:12:01,210 --> 00:12:03,480 that means there was integrity in the transmission. 325 325 00:12:03,480 --> 00:12:04,640 If they don't match, 326 326 00:12:04,640 --> 00:12:06,850 it's going to reject that transmission and ask for it to be 327 327 00:12:06,850 --> 00:12:09,360 sent again, because it assumes it was bad, 328 328 00:12:09,360 --> 00:12:11,380 or there was some kind of an integrity breach. 329 329 00:12:11,380 --> 00:12:12,470 Now, there are lots of different 330 330 00:12:12,470 --> 00:12:13,980 hashing algorithms out there. 331 331 00:12:13,980 --> 00:12:15,230 The first one is MD5, 332 332 00:12:15,230 --> 00:12:16,960 which is the one I used in my examples. 333 333 00:12:16,960 --> 00:12:20,920 This is by far the oldest one, MD5 is 128-bit hash. 334 334 00:12:20,920 --> 00:12:22,620 And it works very well for the most part, 335 335 00:12:22,620 --> 00:12:24,410 and you'll still find it in use today. 336 336 00:12:24,410 --> 00:12:26,470 Now the biggest problem we have with MD5 337 337 00:12:26,470 --> 00:12:29,680 is that the key space is rather small with only 128-bits, 338 338 00:12:29,680 --> 00:12:31,970 which means, there's only so many combinations 339 339 00:12:31,970 --> 00:12:33,700 and those would have to be reused over time 340 340 00:12:33,700 --> 00:12:35,690 because we have an infinite amount of words or phrases 341 341 00:12:35,690 --> 00:12:36,950 that we could have. 342 342 00:12:36,950 --> 00:12:39,100 For example, when we have the word Jason here, 343 343 00:12:39,100 --> 00:12:41,730 and it's MD5 hash shown, there are other words 344 344 00:12:41,730 --> 00:12:44,540 that might also give us that same MD5 hash. 345 345 00:12:44,540 --> 00:12:46,540 So, if I could find another word or phrase 346 346 00:12:46,540 --> 00:12:47,910 that gives me the same hash, 347 347 00:12:47,910 --> 00:12:49,540 this is known as a collision, 348 348 00:12:49,540 --> 00:12:52,260 because two things share the same hash value. 349 349 00:12:52,260 --> 00:12:54,060 We want to be able to minimize the collisions. 350 350 00:12:54,060 --> 00:12:56,790 And the best way to do that is by increasing our key space 351 351 00:12:56,790 --> 00:12:59,240 from 128-bits to something larger. 352 352 00:12:59,240 --> 00:13:02,120 So, computer scientists came up with a new algorithm 353 353 00:13:02,120 --> 00:13:03,720 known as SHA-1. 354 354 00:13:03,720 --> 00:13:06,980 Now SHA-1 is a secure hash algorithm Version one, 355 355 00:13:06,980 --> 00:13:09,570 and it uses 160-bit hash, instead of that 356 356 00:13:09,570 --> 00:13:13,070 128-bit hash digest that we use with MD5. 357 357 00:13:13,070 --> 00:13:15,270 This way we would have less collisions. 358 358 00:13:15,270 --> 00:13:16,410 Now over time though, 359 359 00:13:16,410 --> 00:13:18,560 we found that there were going to be more collisions. 360 360 00:13:18,560 --> 00:13:19,570 Now there's less than MD5, 361 361 00:13:19,570 --> 00:13:21,250 but there's still a good amount of collisions. 362 362 00:13:21,250 --> 00:13:23,420 So, they increase the key size again, 363 363 00:13:23,420 --> 00:13:25,760 and they came up with SHA-256. 364 364 00:13:25,760 --> 00:13:29,220 Now SHA-256 is a 256-bit hash digest, 365 365 00:13:29,220 --> 00:13:31,580 and it gives us a lot more options and choices 366 366 00:13:31,580 --> 00:13:34,360 and less overlap, and therefore fewer collisions. 367 367 00:13:34,360 --> 00:13:38,300 SHA-256 has a much longer hash digest than an MD5 hash. 368 368 00:13:38,300 --> 00:13:41,590 In fact, it's double the length because it's 256-bits 369 369 00:13:41,590 --> 00:13:43,200 instead of 128-bits. 370 370 00:13:43,200 --> 00:13:44,930 Now this doesn't mean there's double the amount 371 371 00:13:44,930 --> 00:13:46,350 of possible combinations. 372 372 00:13:46,350 --> 00:13:49,650 Instead, we have an exponential amount of more combinations 373 373 00:13:49,650 --> 00:13:51,950 because we're going from two to the one 28th 374 374 00:13:51,950 --> 00:13:53,990 to two to the 256 power, 375 375 00:13:53,990 --> 00:13:56,200 which is a much, much bigger number. 376 376 00:13:56,200 --> 00:13:57,710 The final algorithm we need to talk about 377 377 00:13:57,710 --> 00:14:00,260 when we talk about hashes is CRAM-MD5. 378 378 00:14:00,260 --> 00:14:02,670 This is the Challenge Response Authentication Mechanism, 379 379 00:14:02,670 --> 00:14:04,110 message-digest five. 380 380 00:14:04,110 --> 00:14:06,040 And this is a common variant of MD5, 381 381 00:14:06,040 --> 00:14:08,880 and it's usually used in email systems for authentication. 382 382 00:14:08,880 --> 00:14:10,920 All right, let's move to our third component 383 383 00:14:10,920 --> 00:14:12,270 of the CIA Triad. 384 384 00:14:12,270 --> 00:14:14,460 This is the A, for Availability. 385 385 00:14:14,460 --> 00:14:16,750 Now Availability is going to measure the accessibility 386 386 00:14:16,750 --> 00:14:17,880 of that data. 387 387 00:14:17,880 --> 00:14:20,840 Can I get to the data when I want to and where I want to? 388 388 00:14:20,840 --> 00:14:22,350 That's what we're asking here. 389 389 00:14:22,350 --> 00:14:24,720 This is increased by designing redundant networks, 390 390 00:14:24,720 --> 00:14:27,450 by having multiple components doing the same functions. 391 391 00:14:27,450 --> 00:14:29,660 We're going to talk a lot more about redundant networks 392 392 00:14:29,660 --> 00:14:32,010 and talk about high availability and redundancy 393 393 00:14:32,010 --> 00:14:34,180 in a separate lesson, as we start digging more 394 394 00:14:34,180 --> 00:14:35,860 into how we can create good availability 395 395 00:14:35,860 --> 00:14:37,030 within our networks. 396 396 00:14:37,030 --> 00:14:37,863 But for now, 397 397 00:14:37,863 --> 00:14:40,440 let's talk about how availability could be compromised. 398 398 00:14:40,440 --> 00:14:42,210 Well, there's lots of different things that you can do 399 399 00:14:42,210 --> 00:14:43,640 to hurt your availability. 400 400 00:14:43,640 --> 00:14:45,200 You could crash a router or switch 401 401 00:14:45,200 --> 00:14:47,250 by sending improperly format data to it, 402 402 00:14:47,250 --> 00:14:48,830 like the old Ping of Death attack. 403 403 00:14:48,830 --> 00:14:50,630 And that would actually turn off your router or switch 404 404 00:14:50,630 --> 00:14:52,410 and make the entire network go down. 405 405 00:14:52,410 --> 00:14:55,190 Therefore, your availability would be failed as well. 406 406 00:14:55,190 --> 00:14:58,160 Now you can also flood a network with just so much traffic, 407 407 00:14:58,160 --> 00:15:00,380 even if it's legitimate requests that they simply 408 408 00:15:00,380 --> 00:15:02,050 can't be processed in time. 409 409 00:15:02,050 --> 00:15:03,780 This is known as a Denial of Service, 410 410 00:15:03,780 --> 00:15:05,720 or Distributed Denial of Service attack, 411 411 00:15:05,720 --> 00:15:07,730 and this can make your network fail as well. 412 412 00:15:07,730 --> 00:15:09,790 This can also happen when you have a good problem. 413 413 00:15:09,790 --> 00:15:12,450 For instance, if my site became wildly popular overnight, 414 414 00:15:12,450 --> 00:15:14,460 and I had a million people trying to access it all 415 415 00:15:14,460 --> 00:15:16,640 at the same time, that could crush my website 416 416 00:15:16,640 --> 00:15:18,800 because I became too popular, too fast. 417 417 00:15:18,800 --> 00:15:20,950 This would also be considered a Denial of Service, 418 418 00:15:20,950 --> 00:15:22,880 even though it was more of a self-imposed one 419 419 00:15:22,880 --> 00:15:24,710 by becoming too popular. 420 420 00:15:24,710 --> 00:15:26,600 Now, you could also have a power outage in your area, 421 421 00:15:26,600 --> 00:15:28,130 and that could cause your network to fail, 422 422 00:15:28,130 --> 00:15:29,380 or maybe there's a flood, 423 423 00:15:29,380 --> 00:15:30,890 and your server room is now underwater. 424 424 00:15:30,890 --> 00:15:31,770 And guess what? 425 425 00:15:31,770 --> 00:15:34,020 That's going to take a hit to your availability as well. 426 426 00:15:34,020 --> 00:15:36,060 All these are things that can really hurt you. 427 427 00:15:36,060 --> 00:15:37,730 Maybe you have some really old routers and switches 428 428 00:15:37,730 --> 00:15:40,120 that are out of warranty, and one of them dies from old age. 429 429 00:15:40,120 --> 00:15:42,260 Well, that's going to hurt the availability of your network 430 430 00:15:42,260 --> 00:15:43,920 because the network is going to go down 431 431 00:15:43,920 --> 00:15:45,620 when that core switch goes down. 432 432 00:15:45,620 --> 00:15:48,070 I think you get the idea, but we will dive deeper into this 433 433 00:15:48,070 --> 00:15:50,883 later on as we cover availability more in depth.