PROJECTENGRAM

SOFTWARE AND NETWORK SECURITY

Tags: #◇Computer Science #◇NSSECU1 #◇Conceptual #◇Network Security #◇Software Security

◇Overview

This module bridges the gap between securing software applications and protecting the networks they traverse. Network security involves defending against unauthorized access to corporate networks, while software security (AppSec) focuses on embedding security within the Software Development Life Cycle (SDLC) to prevent vulnerabilities like injection and cross-site scripting.

◇Key Definitions

  • Firewall: A network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies.
  • IDS/IPS: Intrusion Detection System (monitors and alerts) and Intrusion Prevention System (blocks active threats).
  • OWASP Top 10: A standard awareness document for developers and web application security detailing the most critical security risks.
  • SDLC: Software Development Life Cycle.

◇Theoretical Framework / Core Concepts

Network Security Architecture

  • OSI Model Security: Security controls can be applied at various layers (e.g., MAC filtering at Layer 2, IPsec at Layer 3, TLS at Layer 4/6, WAF at Layer 7).
  • DMZ (Demilitarized Zone): A physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network (the Internet).
  • VPN (Virtual Private Network): Creates a secure, encrypted connection over a less secure network.

Software Security Concepts

  • Input Validation: Ensuring all user input is sanitized and validated to prevent injection attacks (SQLi, XSS).
  • Secure SDLC (DevSecOps): Integrating security checks (SAST, DAST, SCA) into the CI/CD pipeline.
  • Buffer Overflows: A software vulnerability where a program writes data beyond the allocated memory bounds, potentially leading to arbitrary code execution.

◇Worked Examples / Protocol Walkthroughs / Calculations

TCP Three-Way Handshake & SYN Flood

  1. Normal Handshake: Client sends SYN, Server replies SYN-ACK, Client replies ACK.
  2. SYN Flood Attack: Attacker sends thousands of spoofed SYN packets. Server allocates memory and replies with SYN-ACK, waiting for ACKs that never arrive, leading to resource exhaustion.
  3. Mitigation: SYN Cookies — Server encodes the state into the TCP sequence number rather than allocating memory.

SQL Injection Example

  • Vulnerable Query: SELECT * FROM users WHERE username = '$user' AND password = '$pass'
  • Attack Input: user = "admin' --"
  • Executed Query: SELECT * FROM users WHERE username = 'admin' --' AND password = ''
  • The -- comments out the password check, granting unauthorized access.

◇Summary & Key Takeaways

  • Network security relies on layered defense (Firewalls, IDS/IPS, Network Segmentation).
  • The OWASP Top 10 highlights critical web vulnerabilities, heavily emphasizing injection and broken authentication.
  • Secure coding practices and integrating security into the SDLC are paramount for robust software.

◇References & Navigation

CONFIRMATION // 理解度の確認

ACTIVE RECALL VERIFICATION

Select an answer to verify conceptual comprehension and reveal the technical rationale.

Q1

Which layer of the OSI model does a traditional packet-filtering firewall operate at?

Q2

What is the primary purpose of a DMZ?

Q3

In the TCP three-way handshake, what is the second packet sent?

Q4

Which attack is mitigated by using SYN Cookies?

Q5

What does SAST stand for in software security?

Q6

Which vulnerability involves an attacker executing malicious scripts in the victim's browser?

Q7

How is SQL Injection best prevented?

Q8

A buffer overflow attack primarily targets which system component?

Q9

Which tool is used to monitor network traffic for suspicious activity without blocking it?

Q10

Which protocol is typically used to create a secure VPN tunnel over the internet?

Software and Network Security | PROJECT ENGRAM