1 00:00:00,120 --> 00:00:01,710 In this lesson, we're going to discuss 2 00:00:01,710 --> 00:00:03,816 how you can select secure protocols. 3 00:00:03,816 --> 00:00:06,270 When you are trying to increase the security 4 00:00:06,270 --> 00:00:07,590 of your enterprise network, 5 00:00:07,590 --> 00:00:10,350 it's important to select secure protocols, ports, 6 00:00:10,350 --> 00:00:12,480 and transport methods to ensure that your data 7 00:00:12,480 --> 00:00:15,720 and transit remains confidential and safe from prying eyes. 8 00:00:15,720 --> 00:00:17,070 Which protocols, ports 9 00:00:17,070 --> 00:00:19,470 and transport methods you choose will greatly influence 10 00:00:19,470 --> 00:00:21,780 the security efficiency and reliability 11 00:00:21,780 --> 00:00:23,400 of your enterprise network. 12 00:00:23,400 --> 00:00:25,680 First, you must select a secure protocol 13 00:00:25,680 --> 00:00:27,239 that meets your specific use case. 14 00:00:27,239 --> 00:00:30,120 When it comes to protocols, a protocol is a set of rules 15 00:00:30,120 --> 00:00:32,009 or procedures for transmitting data 16 00:00:32,009 --> 00:00:33,720 between electronic devices. 17 00:00:33,720 --> 00:00:36,750 There are many protocols that can accomplish the same thing, 18 00:00:36,750 --> 00:00:39,317 but which protocol you select can either increase 19 00:00:39,317 --> 00:00:42,212 or decrease the overall security of your networks. 20 00:00:42,212 --> 00:00:45,240 For example, if you want to visit a website, you could do 21 00:00:45,240 --> 00:00:48,839 that by using HTTP or Hypertext Transfer Protocol. 22 00:00:48,839 --> 00:00:51,810 HTTP will transmit your data in plain text, 23 00:00:51,810 --> 00:00:54,210 which makes it susceptible to an on-path 24 00:00:54,210 --> 00:00:55,593 or eavesdropping attack, 25 00:00:56,600 --> 00:00:58,185 where the threat actor could intercept 26 00:00:58,185 --> 00:01:00,003 and read your sensitive communications. 27 00:01:00,003 --> 00:01:01,260 Conversely, you could instead choose 28 00:01:01,260 --> 00:01:04,110 to access their website using hypertext transfer protocol 29 00:01:04,110 --> 00:01:07,830 secure, also, more commonly known as HTTPS, 30 00:01:07,830 --> 00:01:09,960 to encrypt any data that you want to send 31 00:01:09,960 --> 00:01:12,360 before it's transmitted, so that the data is sent 32 00:01:12,360 --> 00:01:14,430 as ciphertext, that is unreadable 33 00:01:14,430 --> 00:01:16,770 to anyone except the intended recipient 34 00:01:16,770 --> 00:01:18,660 who has the proper decryption key 35 00:01:18,660 --> 00:01:21,210 to convert the ciphertext back into human 36 00:01:21,210 --> 00:01:23,100 readable plain text. 37 00:01:23,100 --> 00:01:26,430 Or if you want to conduct a file transfer from your laptop 38 00:01:26,430 --> 00:01:29,940 to a given file server, you can either use FTP 39 00:01:29,940 --> 00:01:32,790 or SFTP to make that file transfer. 40 00:01:32,790 --> 00:01:35,970 If you opt to use the file transfer protocol known as FTP, 41 00:01:35,970 --> 00:01:38,250 your data will be transmitted in plain text, 42 00:01:38,250 --> 00:01:40,950 which makes it susceptible to the same kind of on-path 43 00:01:40,950 --> 00:01:43,721 or eavesdropping attacks as HTTP. 44 00:01:43,721 --> 00:01:46,158 On the other hand, if you opt 45 00:01:46,158 --> 00:01:49,200 to use secure file transfer protocol known as SFTP, 46 00:01:49,200 --> 00:01:51,360 all of your data will be passed between your laptop 47 00:01:51,360 --> 00:01:54,390 and the file server through an encrypted secure shell 48 00:01:54,390 --> 00:01:57,750 or SSH tunnel to ensure that data maintains 49 00:01:57,750 --> 00:02:00,630 its confidentiality during the data transfer. 50 00:02:00,630 --> 00:02:03,027 With HTTP versus HTTPS 51 00:02:03,027 --> 00:02:05,580 and FTP versus SFTP, 52 00:02:05,580 --> 00:02:07,530 we should just choose to use the encrypted version 53 00:02:07,530 --> 00:02:11,130 of the same basic protocol, but that is not always the case. 54 00:02:11,130 --> 00:02:12,450 For example, if you wanted 55 00:02:12,450 --> 00:02:14,820 to remotely control a server using a command prompt 56 00:02:14,820 --> 00:02:17,700 or terminal environment, then you might opt to use Telnet 57 00:02:17,700 --> 00:02:19,500 or secure shell. 58 00:02:19,500 --> 00:02:21,750 Telnet is an older, insecure protocol 59 00:02:21,750 --> 00:02:22,680 that was traditionally used 60 00:02:22,680 --> 00:02:24,300 for remote command line administration 61 00:02:24,300 --> 00:02:26,250 of your servers and network devices. 62 00:02:26,250 --> 00:02:28,470 Telnet is the application layer protocol 63 00:02:28,470 --> 00:02:30,300 that allows a user on one computer 64 00:02:30,300 --> 00:02:31,710 to log into another computer 65 00:02:31,710 --> 00:02:33,360 that is part of the same network. 66 00:02:34,435 --> 00:02:36,660 However, Telnet has significant security flaws 67 00:02:36,660 --> 00:02:39,210 because it doesn't use any type of security or encryption. 68 00:02:39,210 --> 00:02:41,670 So all of the data transmitted using Telnet 69 00:02:41,670 --> 00:02:44,670 including logging credentials like username and password, 70 00:02:44,670 --> 00:02:47,340 are all sent as plain text over the network, 71 00:02:47,340 --> 00:02:49,140 which makes it vulnerable to an on-path 72 00:02:49,140 --> 00:02:50,700 or eavesdropping attack. 73 00:02:50,700 --> 00:02:53,507 On the other hand, if you select the Secure Shell protocol, 74 00:02:53,507 --> 00:02:57,210 usually referred to us SSH, then we will be using a protocol 75 00:02:57,210 --> 00:03:00,000 that still allows for the remote command line administration 76 00:03:00,000 --> 00:03:02,100 of your servers and other network devices, 77 00:03:02,100 --> 00:03:03,840 but it uses strong passwords 78 00:03:03,840 --> 00:03:07,500 and public key authentication to log into the SSH service, 79 00:03:07,500 --> 00:03:09,732 and all of the data being transmitted is encrypted, 80 00:03:09,732 --> 00:03:13,006 therefore making the transfer over the network safe. 81 00:03:13,006 --> 00:03:16,665 So if a system administrator uses SSH to log into a server, 82 00:03:16,665 --> 00:03:19,020 their login credentials are encrypted 83 00:03:19,020 --> 00:03:20,940 before being sent over the network so 84 00:03:20,940 --> 00:03:23,430 that even if someone could intercept that data, 85 00:03:23,430 --> 00:03:24,990 this attacker could not be able 86 00:03:24,990 --> 00:03:27,390 to read it without the proper encryption key. 87 00:03:27,390 --> 00:03:29,609 This makes SSH a much more secure choice 88 00:03:29,609 --> 00:03:32,100 for remote command line administration. 89 00:03:32,100 --> 00:03:33,720 It should always be selected instead 90 00:03:33,720 --> 00:03:36,360 of Telnet on all your systems and networks. 91 00:03:36,360 --> 00:03:39,510 So as a basic rule, always select a protocol 92 00:03:39,510 --> 00:03:40,560 that will use encryption 93 00:03:40,560 --> 00:03:42,120 to protect your data while it is 94 00:03:42,120 --> 00:03:43,740 transferred over a given network. 95 00:03:43,740 --> 00:03:46,972 This includes protocols like HTTPS, SFTP, 96 00:03:46,972 --> 00:03:51,972 SSH, IMAPS, POP3S, 97 00:03:52,433 --> 00:03:57,372 SMTPS, SNMPS and others. 98 00:03:57,372 --> 00:04:01,500 In general, almost every protocol has both an unencrypted 99 00:04:01,500 --> 00:04:03,690 or legacy version and a newer, 100 00:04:03,690 --> 00:04:05,760 more moderate encrypted version. 101 00:04:05,760 --> 00:04:09,150 Most of the time, the protocol will simply add an S 102 00:04:09,150 --> 00:04:12,000 to the end of the unencrypted protocol to signify that 103 00:04:12,000 --> 00:04:14,310 that's a more secure version of that protocol. 104 00:04:14,310 --> 00:04:18,450 For example, if we add the S to HTTP, that's going to give us 105 00:04:18,450 --> 00:04:20,399 HTTPS, which is the encrypted 106 00:04:20,399 --> 00:04:23,769 and more secure version of the Hyper Text Transfer Protocol. 107 00:04:23,769 --> 00:04:26,718 Next, let's consider the port selection process. 108 00:04:26,718 --> 00:04:30,660 Ports or logical constructs that identify specific processes 109 00:04:30,660 --> 00:04:32,700 or services in a given system. 110 00:04:32,700 --> 00:04:35,910 These ports are associated with an IP address for the host 111 00:04:35,910 --> 00:04:37,890 and the protocol type being used. 112 00:04:37,890 --> 00:04:40,680 These ports are categorized into three ranges. 113 00:04:40,680 --> 00:04:44,275 Well-known ports, which are from 0 to 1023, 114 00:04:44,275 --> 00:04:49,275 registered ports, which are from 1024 to 49,151 115 00:04:49,657 --> 00:04:54,640 and dynamic or private ports, which are from 49,152 116 00:04:54,640 --> 00:04:57,354 to 65,535. 117 00:04:57,354 --> 00:05:00,960 Well-known ports are used by system processes or services, 118 00:05:00,960 --> 00:05:04,635 and consist of port ranges, again from 0 to 1023. 119 00:05:04,635 --> 00:05:08,550 Registered ports are usually used by software applications 120 00:05:08,550 --> 00:05:11,747 and utilized a port number between 1024 121 00:05:11,747 --> 00:05:14,179 and 49,151. 122 00:05:14,179 --> 00:05:15,460 Dynamic ports 123 00:05:16,593 --> 00:05:18,690 or private ports are often used for client side connections, 124 00:05:18,690 --> 00:05:21,960 and these range again from 49,152 125 00:05:21,960 --> 00:05:24,899 to port number 65,535. 126 00:05:24,899 --> 00:05:27,998 Dynamic ports are usually randomly assigned 127 00:05:27,998 --> 00:05:29,580 by an operating system. 128 00:05:29,580 --> 00:05:32,130 When you attempt to make a new connection to a well-known 129 00:05:32,130 --> 00:05:34,320 or registered port on another system. 130 00:05:34,320 --> 00:05:36,660 For well-known and registered ports, you'll find 131 00:05:36,660 --> 00:05:37,890 that the default port number 132 00:05:37,890 --> 00:05:40,680 for a protocol will also indicate if it is a secure 133 00:05:40,680 --> 00:05:43,080 or insecure port and protocol. 134 00:05:43,080 --> 00:05:46,890 Consider the example for our HTTP and HTTPS ports. 135 00:05:46,890 --> 00:05:50,370 If you select HTTP, you'll be using port 80 by default 136 00:05:50,370 --> 00:05:52,560 for your web server, which relies on the hyper 137 00:05:52,560 --> 00:05:54,357 text transfer protocol. 138 00:05:54,357 --> 00:05:57,120 On the other hand, if you select HTTPS, 139 00:05:57,120 --> 00:06:01,050 you'll be using Port 443 by default for your web server, 140 00:06:01,050 --> 00:06:04,140 which will rely on the hypertext transfer protocol secure, 141 00:06:04,140 --> 00:06:05,100 which uses encryption 142 00:06:05,100 --> 00:06:08,760 to protect the data being sent over the HTTPS protocol. 143 00:06:08,760 --> 00:06:11,582 If you want to force all of your users to access your server 144 00:06:11,582 --> 00:06:15,600 by only using the more secure HTTPS connection, then 145 00:06:15,600 --> 00:06:19,290 you need to ensure that Port 443 is open on your firewall 146 00:06:19,290 --> 00:06:22,590 while port 80 is closed or blocked on your firewall. 147 00:06:22,590 --> 00:06:25,203 If you consider the ports for email, you will see 148 00:06:25,203 --> 00:06:28,505 that we have a few options to consider including SMTP 149 00:06:28,505 --> 00:06:32,220 and SMTPS for sending emails or POP3 150 00:06:32,220 --> 00:06:36,990 or POP3S, IMAP and IMAPS for receiving emails. 151 00:06:36,990 --> 00:06:40,410 The Simple Mail transfer protocol comes in two varieties, 152 00:06:40,410 --> 00:06:44,569 SMTP and SMTPS, and both are used for sending emails. 153 00:06:44,569 --> 00:06:47,145 SMTP is the insecure version 154 00:06:47,145 --> 00:06:50,067 that operates in plain text over Port 25, 155 00:06:50,067 --> 00:06:52,500 but SMTPS is the secure 156 00:06:52,500 --> 00:06:56,329 and encrypted version that operates over port 587 instead. 157 00:06:56,329 --> 00:06:58,890 If you are trying to receive emails, 158 00:06:58,890 --> 00:07:01,800 you can either use the Post Office Protocol 3 159 00:07:01,800 --> 00:07:04,327 or the Internet Message Access Protocol. 160 00:07:04,327 --> 00:07:08,280 The Post Office Protocol 3 comes in the default POP3 161 00:07:08,280 --> 00:07:11,760 version, and the more secure POP3S version. 162 00:07:11,760 --> 00:07:14,400 The Post Office Protocol 3 is an email protocol 163 00:07:14,400 --> 00:07:16,683 that allows for the retrieval 164 00:07:16,683 --> 00:07:19,582 of email messages from a mail server going over port 110. 165 00:07:19,582 --> 00:07:22,803 But if you use the encrypted version of POP3S, 166 00:07:22,803 --> 00:07:26,400 you'll instead use Port 995 to receive your emails. 167 00:07:26,400 --> 00:07:29,580 The internet message access protocol, on the other hand, 168 00:07:29,580 --> 00:07:32,520 is the more modern email protocol that provides access 169 00:07:32,520 --> 00:07:34,950 to email messages stored on a mail server 170 00:07:34,950 --> 00:07:37,102 and enables users to manage their email accounts 171 00:07:37,102 --> 00:07:38,882 over Port 143. 172 00:07:38,882 --> 00:07:42,300 If you opt to use the encrypted version of IMAP, 173 00:07:42,300 --> 00:07:45,030 we will call this IMAPS or IMAP Secure, 174 00:07:45,030 --> 00:07:46,830 and it will encrypt all of your emails 175 00:07:46,830 --> 00:07:50,176 before they are received by you over Port 993. 176 00:07:50,176 --> 00:07:53,040 In terms of these various email protocols, 177 00:07:53,040 --> 00:07:55,920 they will all work fine depending on your use case, 178 00:07:55,920 --> 00:07:57,960 but you should really use the secure version 179 00:07:57,960 --> 00:08:00,510 of these ports instead of their unencrypted varieties 180 00:08:00,510 --> 00:08:02,550 to help protect your emails from being intercepted 181 00:08:02,550 --> 00:08:04,860 and read by unauthorized individuals. 182 00:08:04,860 --> 00:08:07,800 When selecting ports, it's important to follow the principle 183 00:08:07,800 --> 00:08:10,470 of least privilege, which means only opening the ports 184 00:08:10,470 --> 00:08:12,300 necessary for your application to function 185 00:08:12,300 --> 00:08:13,890 and blocking all others. 186 00:08:13,890 --> 00:08:15,780 This will help to minimize the attack surface 187 00:08:15,780 --> 00:08:17,699 and reduce your chances of unauthorized access 188 00:08:17,699 --> 00:08:19,939 or a data breach from occurring. 189 00:08:19,939 --> 00:08:21,838 Also, when it comes to ports, 190 00:08:21,838 --> 00:08:24,441 default port numbers are associated with specific services 191 00:08:24,441 --> 00:08:27,810 or protocols to simplify the communication process. 192 00:08:27,810 --> 00:08:31,440 For instance, HTTP typically uses Port 80 while 193 00:08:31,440 --> 00:08:33,678 HTTPS uses Port 443. 194 00:08:33,678 --> 00:08:36,520 These default assignments make it easier for devices 195 00:08:36,520 --> 00:08:38,100 to connect and communicate 196 00:08:38,100 --> 00:08:40,409 with one another without needing to specify a port 197 00:08:40,409 --> 00:08:42,480 explicitly, however, users 198 00:08:42,480 --> 00:08:44,718 and administrators have the flexibility 199 00:08:44,718 --> 00:08:45,660 to configure their systems to use different 200 00:08:45,660 --> 00:08:47,490 port numbers if they prefer. 201 00:08:47,490 --> 00:08:49,350 This flexibility allows for customization 202 00:08:49,350 --> 00:08:51,690 and can enhance security to some extent. 203 00:08:51,690 --> 00:08:54,210 Using default port numbers can be less secure 204 00:08:54,210 --> 00:08:57,086 because malicious actors often target these well-known ports 205 00:08:57,086 --> 00:08:59,790 in their attempts to exploit vulnerabilities. 206 00:08:59,790 --> 00:09:01,860 By using non-standard port numbers such as 207 00:09:01,860 --> 00:09:04,890 by assigning port 8888 to your web server, instead 208 00:09:04,890 --> 00:09:07,440 of using Port 80, you can make your services less 209 00:09:07,440 --> 00:09:09,300 predictable to some extent, 210 00:09:09,300 --> 00:09:11,609 and more challenging for attackers to find and target. 211 00:09:11,609 --> 00:09:13,920 However, it's important to note 212 00:09:13,920 --> 00:09:15,960 that while changing port numbers can add a layer 213 00:09:15,960 --> 00:09:18,420 of obscurity, it should not be considered a substitute 214 00:09:18,420 --> 00:09:21,204 for more robust security measures, such 215 00:09:21,204 --> 00:09:22,230 as a strong authentication, encryption, 216 00:09:22,230 --> 00:09:24,270 and regular security updates. 217 00:09:24,270 --> 00:09:26,520 Additionally, using non-standard ports may make 218 00:09:26,520 --> 00:09:28,620 troubleshooting and administration more complex, 219 00:09:28,620 --> 00:09:30,210 so it should be done thoughtfully 220 00:09:30,210 --> 00:09:31,980 and documented carefully if your organization 221 00:09:31,980 --> 00:09:33,630 decides to use its approach. 222 00:09:33,630 --> 00:09:35,760 Personally, I found that there isn't much security 223 00:09:35,760 --> 00:09:37,560 to be gained by using alternative port numbers 224 00:09:37,560 --> 00:09:39,000 instead of the defaults, 225 00:09:39,000 --> 00:09:41,370 but you will still see some organizations using this 226 00:09:41,370 --> 00:09:43,980 non-standard ports for some of their services, especially 227 00:09:43,980 --> 00:09:46,230 inside of their internal networks. 228 00:09:46,230 --> 00:09:48,840 Finally, let's take a look at different transport methods 229 00:09:48,840 --> 00:09:51,086 that you can choose to utilize in your enterprise networks. 230 00:09:51,086 --> 00:09:52,980 A transfer method refers 231 00:09:52,980 --> 00:09:55,209 to the way data is moved from one place to another, 232 00:09:55,209 --> 00:09:59,326 usually using either TCP or UDP to transmit the data. 233 00:09:59,326 --> 00:10:01,410 The Transmission Control Protocol 234 00:10:01,410 --> 00:10:03,806 or TCP is a connection-oriented protocol 235 00:10:03,806 --> 00:10:06,408 that ensures data is delivered without any errors. 236 00:10:06,408 --> 00:10:08,970 TCP is able to ensure this delivery 237 00:10:08,970 --> 00:10:11,465 by establishing a connection before data is transferred, 238 00:10:11,465 --> 00:10:13,770 and it's using acknowledgements, 239 00:10:13,770 --> 00:10:15,987 retransmissions of lost data 240 00:10:15,987 --> 00:10:17,310 and sequencing to ensure that integrity 241 00:10:17,310 --> 00:10:18,960 of the data is being transmitted. 242 00:10:18,960 --> 00:10:22,020 This makes TCP ideal for applications 243 00:10:22,020 --> 00:10:24,441 where data accuracy is important, such as when sending data 244 00:10:24,441 --> 00:10:28,200 to or from a web server or email server. 245 00:10:28,200 --> 00:10:29,033 For example, 246 00:10:29,033 --> 00:10:31,104 whenever you try to connect to a given website, 247 00:10:31,104 --> 00:10:32,785 your browser uses HTTP 248 00:10:32,785 --> 00:10:35,753 or HTTPS to request webpages from the server 249 00:10:35,753 --> 00:10:38,451 using the TCP transport method. 250 00:10:38,451 --> 00:10:40,710 TCP ensures that all 251 00:10:40,710 --> 00:10:42,450 of the webpages arrive correctly 252 00:10:42,450 --> 00:10:45,289 and in the right order for processing by your web browser. 253 00:10:45,289 --> 00:10:47,400 If any data is lost in the transmission, 254 00:10:47,400 --> 00:10:50,490 the TCP method will automatically retransmit the data 255 00:10:50,490 --> 00:10:51,990 to ensure that the webpage 256 00:10:51,990 --> 00:10:54,480 that you see in the browser is exactly as it should be 257 00:10:54,480 --> 00:10:57,150 with no missing or out of order data. 258 00:10:57,150 --> 00:11:00,440 On the other hand, the user data ground protocol 259 00:11:00,440 --> 00:11:02,970 or UDP, is a connectionless protocol 260 00:11:02,970 --> 00:11:04,470 that doesn't guarantee delivery, 261 00:11:04,470 --> 00:11:07,560 and instead simply sends data grounds without establishing 262 00:11:07,560 --> 00:11:10,590 a connection, and UDP does not provide any error checking 263 00:11:10,590 --> 00:11:12,030 or recovery services. 264 00:11:12,030 --> 00:11:15,322 This makes UDP much faster and more efficient than TCP, 265 00:11:15,322 --> 00:11:17,850 but could result in data packets being 266 00:11:17,850 --> 00:11:19,530 lost during the transmission. 267 00:11:19,530 --> 00:11:21,000 This makes UDP more suitable 268 00:11:21,000 --> 00:11:22,770 for applications like streaming video 269 00:11:22,770 --> 00:11:24,670 or gaming where speed is more important 270 00:11:24,670 --> 00:11:26,460 than the complete accuracy. 271 00:11:26,460 --> 00:11:28,440 For example, if you're streaming this video 272 00:11:28,440 --> 00:11:30,472 and one frame is lost in a transmission from our service 273 00:11:30,472 --> 00:11:33,416 to your browser, you likely won't even notice a difference. 274 00:11:33,416 --> 00:11:36,900 This is because video plays about 30 frames per second, 275 00:11:36,900 --> 00:11:39,240 and the human eye has a hard time seeing missing frames 276 00:11:39,240 --> 00:11:41,534 as long as 24 or more frames per second are received. 277 00:11:41,534 --> 00:11:44,580 So, if the video only shows you 29 frames instead 278 00:11:44,580 --> 00:11:46,080 of the 30 frames each second, 279 00:11:46,080 --> 00:11:47,820 you likely won't even notice the difference. 280 00:11:47,820 --> 00:11:50,730 And this is why UDP is a great choice for streaming video 281 00:11:50,730 --> 00:11:53,940 and other near real-time communications that can allow 282 00:11:53,940 --> 00:11:56,008 for some lost data without affecting the end result 283 00:11:56,008 --> 00:11:58,290 the user is attempting to achieve. 284 00:11:58,290 --> 00:12:00,870 For example, streaming video services like YouTube 285 00:12:00,870 --> 00:12:04,110 or Netflix heavily used UDP because it provides more speed 286 00:12:04,110 --> 00:12:06,064 and efficiency for their data transmission needs. 287 00:12:06,064 --> 00:12:09,510 While TCP would ensure the delivery of all packets, it does 288 00:12:09,510 --> 00:12:11,940 so at a cost of speed and increased overhead, 289 00:12:11,940 --> 00:12:13,050 which makes it unsuitable 290 00:12:13,050 --> 00:12:15,840 for video streaming, where a few lost packets do not 291 00:12:15,840 --> 00:12:18,270 significantly impact the overall viewing experience. 292 00:12:18,270 --> 00:12:21,420 With UDP, data packets are continuously streamed 293 00:12:21,420 --> 00:12:23,670 and if packets are lost, the video player simply 294 00:12:23,670 --> 00:12:25,020 skips over the lost data 295 00:12:25,020 --> 00:12:27,150 and continues with the next data available 296 00:12:27,150 --> 00:12:29,411 to ensure a smoother playback for the end user. 297 00:12:29,411 --> 00:12:32,820 When you are attempting to select the right transport method 298 00:12:32,820 --> 00:12:34,200 for your organization's needs, 299 00:12:34,200 --> 00:12:36,510 you should first consider the nature of your application. 300 00:12:36,510 --> 00:12:37,680 If the application requires 301 00:12:37,680 --> 00:12:40,410 that data integrity be maintained as your top priority, 302 00:12:40,410 --> 00:12:42,690 then you should select transmission control protocol 303 00:12:42,690 --> 00:12:44,820 or TCP to meet your needs. 304 00:12:44,820 --> 00:12:46,707 If instead, you want to prioritize the speed 305 00:12:46,707 --> 00:12:48,840 and efficiency of your data transmission, 306 00:12:48,840 --> 00:12:50,420 using the user datagram protocol 307 00:12:50,420 --> 00:12:53,423 or UDP might be a more suitable choice to meet your needs. 308 00:12:53,423 --> 00:12:57,507 So remember, you should always opt for secure protocols 309 00:12:57,507 --> 00:12:59,220 that provide encryption, 310 00:12:59,220 --> 00:13:01,370 especially when transmitting sensitive data 311 00:13:02,467 --> 00:13:04,560 or over an untrusted network like the Internet. 312 00:13:04,560 --> 00:13:08,904 Protocols like HTTPS, SFTP, SSH, 313 00:13:08,904 --> 00:13:13,904 IMAPS, POP3S, SMTPS 314 00:13:14,583 --> 00:13:18,904 and SNMPS all rely on encryption as part 315 00:13:18,904 --> 00:13:22,380 of their protocols to ensure your data remains confidential 316 00:13:22,380 --> 00:13:24,584 while being transferred over a given network. 317 00:13:24,584 --> 00:13:27,747 Once you select the protocol, you can then assign the port 318 00:13:27,747 --> 00:13:29,160 that their protocol will use 319 00:13:29,160 --> 00:13:31,800 with ports being categorized into three ranges, 320 00:13:31,800 --> 00:13:34,918 well-known ports, which range from 0 to 1023 321 00:13:34,918 --> 00:13:39,918 registered ports, which range from 1024 to 49,151 322 00:13:40,219 --> 00:13:44,256 and dynamic or private ports which range from 49,152 323 00:13:44,256 --> 00:13:47,179 to 65,535. 324 00:13:47,179 --> 00:13:50,190 Your system should also follow the principle 325 00:13:50,190 --> 00:13:53,220 of least privilege by only opening necessary ports, 326 00:13:53,220 --> 00:13:56,010 while blocking all unneeded ports on your network 327 00:13:56,010 --> 00:13:58,020 and systems to reduce the attack surface 328 00:13:58,020 --> 00:14:00,840 and minimize the risk of unauthorized access. 329 00:14:00,840 --> 00:14:03,690 Finally, you need to select the transport method by opting 330 00:14:03,690 --> 00:14:05,595 to use either TCP or UDP. 331 00:14:05,595 --> 00:14:08,230 The Transmission Control Protocol or TCP 332 00:14:08,230 --> 00:14:10,609 is a connection-oriented protocol 333 00:14:10,609 --> 00:14:13,440 that ensures data is delivered without any errors 334 00:14:13,440 --> 00:14:14,760 by providing error checking 335 00:14:14,760 --> 00:14:16,830 and retransmission if the package are lost. 336 00:14:16,830 --> 00:14:18,900 The User Datagram Protocol or UDP, 337 00:14:18,900 --> 00:14:21,630 on the other hand, is a connectionless protocol 338 00:14:21,630 --> 00:14:23,400 that doesn't guarantee data delivery, 339 00:14:23,400 --> 00:14:26,250 and instead simply sends data grounds without establishing 340 00:14:26,250 --> 00:14:29,550 a connection, and UDP does not provide any error 341 00:14:29,550 --> 00:14:31,350 checking or recovery services. 342 00:14:31,350 --> 00:14:34,320 By making informed choices about the protocols, ports, 343 00:14:34,320 --> 00:14:36,000 and transport methods used, 344 00:14:36,000 --> 00:14:38,790 you can significantly enhance the security, efficiency 345 00:14:38,790 --> 00:14:41,690 and reliability of your organization's enterprise network.