Chapter 6: Understanding Secure and Insecure Protocols

In this chapter, we will be looking at secure protocols and their uses, known as use cases. We will also cover insecure protocols, as you need to know their functions so that you know which secure protocol is the most suitable one to replace it with. The topics discussed in this chapter appear very often in the Security+ exam.

In this chapter, we are going to cover the following topics:

• Introduction to Protocols
• Insecure Protocols and Their Use Cases
• Secure Protocols and Their Use Cases
• Additional Use Cases and Their Protocols

Introduction to Protocols

Protocol refers to the rules required by different applications for the exchange of data, where the application can perform actions such as running commands on remote systems, sending and receiving emails, and downloading files from the internet. Each application has a special port number that it uses for communication. You can think of ports as being TV channels: if we want to watch sport, we go to the sports channels; if we want to watch the news, we go to the news channel. Applications are the same (if we want to send an email, we use an email application), and they all have a distinct port number for each communication mode.

There are two types of ports: Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). The main difference between the two is that TCP is connection-oriented as it uses a three-way handshake, and UDP is faster but less reliable as it is connectionless. The following diagram shows the three-way handshake:

...

Insecure Protocols and Their Use Cases

In this section, we are going to look in detail at the different insecure protocols. As most protocols use TCP ports, this chapter will only mention the UDP ports, and therefore you can assume that if something is not labeled UDP, it is TCP. We will look at the unsecure protocols and their use cases:

Let's look at each of them:

• FTP: Transferring files is a common function. When we purchase an e-book, it is immediately available to download onto our desktop. If I wish to upload files to a web server, I would use FTP on port 20, but the more common use is to download files using port 21, which is known as Passive FTP. The downside of using FTP is that the transfer is done using clear text, so a packet sniffer could view the information. It could be replaced by secure protocols such as SFTP or FTPS.
• Telnet: This is a protocol that was first used in 1973 to run remote commands on devices such as routers...

Secure Protocols and Their Use Cases

In this section, we are going to look in detail at the various secure protocols and their use cases. The Security+ exam wants you to select the correct secure protocol for a given scenario to make your environment secure.

As most protocols use TCP ports, I will only mention the UDP ports, and therefore you can assume that if something is not labeled UDP, it is TCP. We will look at the secure protocols and their use cases:

Let's look at each of them:

• SSH: This was invented to replace Telnet so that commands could be run securely; it is commonly used when you want remote access to network devices. It can be used as a command-line tool or in a Graphical User Interface (GUI), but it is not browser-based.
• SCP: This is used to transfer files securely between hosts in a Linux environment.
• SFTP: This allows us to encrypt authentication and download files securely so that they cannot be tampered with...

Additional Use Cases and Their Protocols

In this section, we are going to look at additional use cases for subscription services, routing, switching, and Active Directory.

Subscription Services and Their Protocols

In the past, the traditional method for purchasing application software was to purchase the application on a DVD from a local store or wait 3-4 days for it to be delivered from Amazon. At that time, you would have to pay $300–$400 for the software. With the advent and evolution of the cloud, you can now obtain your applications through subscription services, where you pay a monthly fee and can download the application immediately. Two examples of this are as follows:

• Office 365: Office 365 is from Microsoft, where you not only get email services, but you also get Skype, SharePoint, and Office applications.
• Adobe Acrobat Pro: Adobe Acrobat Pro is one of the premier applications that allows you to create and modify PDF files.

Routing and Its...

Review Questions

Now it's time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Solutions section at the end of the book:

1. What is the authentication protocol that uses tickets and prevents replay attacks?
2. Describe how IPSec tunnel mode works.
3. Describe how IPSec transport mode works.
4. If an IT administrator uses Telnet to run remote commands on a router, which secure protocol can it be replaced with?
5. What is the purpose of a router?
6. What is the purpose of a switch?
7. What type of service is Spotify?
8. Explain how port security works.
9. Describe how a managed switch with 802.1x works.
10. What are the three portions of a distinguished name and the order that they come in?
11. Which protocol can you use to prevent DNS poisoning?
12. What are the two reasons why a computer might not receive an IP address from a DHCP server?
13. What type of server would both a SIEM server and a Microsoft domain...