In this lesson, we're going to discuss
how you can select secure protocols.
When you are trying to increase the security
of your enterprise network,
it's important to select secure protocols, ports,
and transport methods to ensure that your data
and transit remains confidential and safe from prying eyes.
Which protocols, ports
and transport methods you choose will greatly influence
the security efficiency and reliability
of your enterprise network.
First, you must select a secure protocol
that meets your specific use case.
When it comes to protocols, a protocol is a set of rules
or procedures for transmitting data
between electronic devices.
There are many protocols that can accomplish the same thing,
but which protocol you select can either increase
or decrease the overall security of your networks.
For example, if you want to visit a website, you could do
that by using HTTP or Hypertext Transfer Protocol.
HTTP will transmit your data in plain text,
which makes it susceptible to an on-path
or eavesdropping attack,
where the threat actor could intercept
and read your sensitive communications.
Conversely, you could instead choose
to access their website using hypertext transfer protocol
secure, also, more commonly known as HTTPS,
to encrypt any data that you want to send
before it's transmitted, so that the data is sent
as ciphertext, that is unreadable
to anyone except the intended recipient
who has the proper decryption key
to convert the ciphertext back into human
readable plain text.
Or if you want to conduct a file transfer from your laptop
to a given file server, you can either use FTP
or SFTP to make that file transfer.
If you opt to use the file transfer protocol known as FTP,
your data will be transmitted in plain text,
which makes it susceptible to the same kind of on-path
or eavesdropping attacks as HTTP.
On the other hand, if you opt
to use secure file transfer protocol known as SFTP,
all of your data will be passed between your laptop
and the file server through an encrypted secure shell
or SSH tunnel to ensure that data maintains
its confidentiality during the data transfer.
With HTTP versus HTTPS
and FTP versus SFTP,
we should just choose to use the encrypted version
of the same basic protocol, but that is not always the case.
For example, if you wanted
to remotely control a server using a command prompt
or terminal environment, then you might opt to use Telnet
or secure shell.
Telnet is an older, insecure protocol
that was traditionally used
for remote command line administration
of your servers and network devices.
Telnet is the application layer protocol
that allows a user on one computer
to log into another computer
that is part of the same network.
However, Telnet has significant security flaws
because it doesn't use any type of security or encryption.
So all of the data transmitted using Telnet
including logging credentials like username and password,
are all sent as plain text over the network,
which makes it vulnerable to an on-path
or eavesdropping attack.
On the other hand, if you select the Secure Shell protocol,
usually referred to us SSH, then we will be using a protocol
that still allows for the remote command line administration
of your servers and other network devices,
but it uses strong passwords
and public key authentication to log into the SSH service,
and all of the data being transmitted is encrypted,
therefore making the transfer over the network safe.
So if a system administrator uses SSH to log into a server,
their login credentials are encrypted
before being sent over the network so
that even if someone could intercept that data,
this attacker could not be able
to read it without the proper encryption key.
This makes SSH a much more secure choice
for remote command line administration.
It should always be selected instead
of Telnet on all your systems and networks.
So as a basic rule, always select a protocol
that will use encryption
to protect your data while it is
transferred over a given network.
This includes protocols like HTTPS, SFTP,
SSH, IMAPS, POP3S,
SMTPS, SNMPS and others.
In general, almost every protocol has both an unencrypted
or legacy version and a newer,
more moderate encrypted version.
Most of the time, the protocol will simply add an S
to the end of the unencrypted protocol to signify that
that's a more secure version of that protocol.
For example, if we add the S to HTTP, that's going to give us
HTTPS, which is the encrypted
and more secure version of the Hyper Text Transfer Protocol.
Next, let's consider the port selection process.
Ports or logical constructs that identify specific processes
or services in a given system.
These ports are associated with an IP address for the host
and the protocol type being used.
These ports are categorized into three ranges.
Well-known ports, which are from 0 to 1023,
registered ports, which are from 1024 to 49,151
and dynamic or private ports, which are from 49,152
to 65,535.
Well-known ports are used by system processes or services,
and consist of port ranges, again from 0 to 1023.
Registered ports are usually used by software applications
and utilized a port number between 1024
and 49,151.
Dynamic ports
or private ports are often used for client side connections,
and these range again from 49,152
to port number 65,535.
Dynamic ports are usually randomly assigned
by an operating system.
When you attempt to make a new connection to a well-known
or registered port on another system.
For well-known and registered ports, you'll find
that the default port number
for a protocol will also indicate if it is a secure
or insecure port and protocol.
Consider the example for our HTTP and HTTPS ports.
If you select HTTP, you'll be using port 80 by default
for your web server, which relies on the hyper
text transfer protocol.
On the other hand, if you select HTTPS,
you'll be using Port 443 by default for your web server,
which will rely on the hypertext transfer protocol secure,
which uses encryption
to protect the data being sent over the HTTPS protocol.
If you want to force all of your users to access your server
by only using the more secure HTTPS connection, then
you need to ensure that Port 443 is open on your firewall
while port 80 is closed or blocked on your firewall.
If you consider the ports for email, you will see
that we have a few options to consider including SMTP
and SMTPS for sending emails or POP3
or POP3S, IMAP and IMAPS for receiving emails.
The Simple Mail transfer protocol comes in two varieties,
SMTP and SMTPS, and both are used for sending emails.
SMTP is the insecure version
that operates in plain text over Port 25,
but SMTPS is the secure
and encrypted version that operates over port 587 instead.
If you are trying to receive emails,
you can either use the Post Office Protocol 3
or the Internet Message Access Protocol.
The Post Office Protocol 3 comes in the default POP3
version, and the more secure POP3S version.
The Post Office Protocol 3 is an email protocol
that allows for the retrieval
of email messages from a mail server going over port 110.
But if you use the encrypted version of POP3S,
you'll instead use Port 995 to receive your emails.
The internet message access protocol, on the other hand,
is the more modern email protocol that provides access
to email messages stored on a mail server
and enables users to manage their email accounts
over Port 143.
If you opt to use the encrypted version of IMAP,
we will call this IMAPS or IMAP Secure,
and it will encrypt all of your emails
before they are received by you over Port 993.
In terms of these various email protocols,
they will all work fine depending on your use case,
but you should really use the secure version
of these ports instead of their unencrypted varieties
to help protect your emails from being intercepted
and read by unauthorized individuals.
When selecting ports, it's important to follow the principle
of least privilege, which means only opening the ports
necessary for your application to function
and blocking all others.
This will help to minimize the attack surface
and reduce your chances of unauthorized access
or a data breach from occurring.
Also, when it comes to ports,
default port numbers are associated with specific services
or protocols to simplify the communication process.
For instance, HTTP typically uses Port 80 while
HTTPS uses Port 443.
These default assignments make it easier for devices
to connect and communicate
with one another without needing to specify a port
explicitly, however, users
and administrators have the flexibility
to configure their systems to use different
port numbers if they prefer.
This flexibility allows for customization
and can enhance security to some extent.
Using default port numbers can be less secure
because malicious actors often target these well-known ports
in their attempts to exploit vulnerabilities.
By using non-standard port numbers such as
by assigning port 8888 to your web server, instead
of using Port 80, you can make your services less
predictable to some extent,
and more challenging for attackers to find and target.
However, it's important to note
that while changing port numbers can add a layer
of obscurity, it should not be considered a substitute
for more robust security measures, such
as a strong authentication, encryption,
and regular security updates.
Additionally, using non-standard ports may make
troubleshooting and administration more complex,
so it should be done thoughtfully
and documented carefully if your organization
decides to use its approach.
Personally, I found that there isn't much security
to be gained by using alternative port numbers
instead of the defaults,
but you will still see some organizations using this
non-standard ports for some of their services, especially
inside of their internal networks.
Finally, let's take a look at different transport methods
that you can choose to utilize in your enterprise networks.
A transfer method refers
to the way data is moved from one place to another,
usually using either TCP or UDP to transmit the data.
The Transmission Control Protocol
or TCP is a connection-oriented protocol
that ensures data is delivered without any errors.
TCP is able to ensure this delivery
by establishing a connection before data is transferred,
and it's using acknowledgements,
retransmissions of lost data
and sequencing to ensure that integrity
of the data is being transmitted.
This makes TCP ideal for applications
where data accuracy is important, such as when sending data
to or from a web server or email server.
For example,
whenever you try to connect to a given website,
your browser uses HTTP
or HTTPS to request webpages from the server
using the TCP transport method.
TCP ensures that all
of the webpages arrive correctly
and in the right order for processing by your web browser.
If any data is lost in the transmission,
the TCP method will automatically retransmit the data
to ensure that the webpage
that you see in the browser is exactly as it should be
with no missing or out of order data.
On the other hand, the user data ground protocol
or UDP, is a connectionless protocol
that doesn't guarantee delivery,
and instead simply sends data grounds without establishing
a connection, and UDP does not provide any error checking
or recovery services.
This makes UDP much faster and more efficient than TCP,
but could result in data packets being
lost during the transmission.
This makes UDP more suitable
for applications like streaming video
or gaming where speed is more important
than the complete accuracy.
For example, if you're streaming this video
and one frame is lost in a transmission from our service
to your browser, you likely won't even notice a difference.
This is because video plays about 30 frames per second,
and the human eye has a hard time seeing missing frames
as long as 24 or more frames per second are received.
So, if the video only shows you 29 frames instead
of the 30 frames each second,
you likely won't even notice the difference.
And this is why UDP is a great choice for streaming video
and other near real-time communications that can allow
for some lost data without affecting the end result
the user is attempting to achieve.
For example, streaming video services like YouTube
or Netflix heavily used UDP because it provides more speed
and efficiency for their data transmission needs.
While TCP would ensure the delivery of all packets, it does
so at a cost of speed and increased overhead,
which makes it unsuitable
for video streaming, where a few lost packets do not
significantly impact the overall viewing experience.
With UDP, data packets are continuously streamed
and if packets are lost, the video player simply
skips over the lost data
and continues with the next data available
to ensure a smoother playback for the end user.
When you are attempting to select the right transport method
for your organization's needs,
you should first consider the nature of your application.
If the application requires
that data integrity be maintained as your top priority,
then you should select transmission control protocol
or TCP to meet your needs.
If instead, you want to prioritize the speed
and efficiency of your data transmission,
using the user datagram protocol
or UDP might be a more suitable choice to meet your needs.
So remember, you should always opt for secure protocols
that provide encryption,
especially when transmitting sensitive data
or over an untrusted network like the Internet.
Protocols like HTTPS, SFTP, SSH,
IMAPS, POP3S, SMTPS
and SNMPS all rely on encryption as part
of their protocols to ensure your data remains confidential
while being transferred over a given network.
Once you select the protocol, you can then assign the port
that their protocol will use
with ports being categorized into three ranges,
well-known ports, which range from 0 to 1023
registered ports, which range from 1024 to 49,151
and dynamic or private ports which range from 49,152
to 65,535.
Your system should also follow the principle
of least privilege by only opening necessary ports,
while blocking all unneeded ports on your network
and systems to reduce the attack surface
and minimize the risk of unauthorized access.
Finally, you need to select the transport method by opting
to use either TCP or UDP.
The Transmission Control Protocol or TCP
is a connection-oriented protocol
that ensures data is delivered without any errors
by providing error checking
and retransmission if the package are lost.
The User Datagram Protocol or UDP,
on the other hand, is a connectionless protocol
that doesn't guarantee data delivery,
and instead simply sends data grounds without establishing
a connection, and UDP does not provide any error
checking or recovery services.
By making informed choices about the protocols, ports,
and transport methods used,
you can significantly enhance the security, efficiency
and reliability of your organization's enterprise network.