Internet Security

Data Link L (Layer 2)

-responsible for formatting the packet from the network layer into the proper format for transmission -adds the hardware source (MAC) and destination addresses to the frame -contains two sublayers: 1) LLC (logical link control) 2) MAC sublayer The data link layer is very similar to the network layer, except the data link layer facilitates data transfer between two devices on the SAME network. The data link layer takes packets from the network layer and breaks them into smaller pieces called frames. Like the network layer, the data link layer is also responsible for flow control and error control in intra-network communication (The transport layer only does flow control and error control for inter-network communications).

DDoS (Distributed Denial of Service)

An attack on a computer or network device in which multiple computers send data and requests to the device in an attempt to overwhelm it so that it cannot perform normal operations. When a victim's server or network is targeted by the botnet, each bot sends requests to the target's IP address, potentially causing the server or network to become overwhelmed, resulting in a denial-of-service to normal traffic.

BEC

Business Email Compromise

DNS server

Domain Name System. A database system that translates an IP address into a domain name. A name given to a host computer on the internet.

zombie/bots/botnets

Individual devices that have been infected with malware: attacks are directed by sending remote instructions to each bot

ISP

Internet Service Provider

SEG

Secure Email Gateway

TCP/IP (Transmission Control Protocol/Internet Protocol)

The TCP/IP relationship is similar to sending someone a message written on a puzzle through the mail. The message is written down and the puzzle is broken into pieces. Each piece then can travel through a different postal route, some of which take longer than others. When the puzzle pieces arrive after traversing their different paths, the pieces may be out of order. The Internet Protocol makes sure the pieces arrive at their destination address. The TCP protocol can be thought of as the puzzle assembler on the other side who puts the pieces together in the right order, asks for missing pieces to be resent, and lets the sender know the puzzle has been received. TCP maintains the connection with the sender from before the first puzzle piece is sent to after the final piece is sent. IP is a connectionless protocol, which means that each unit of data is individually addressed and routed from the source device to the target device, and the target does not send an acknowledgement back to the source. That's where protocols such as the Transmission Control Protocol (TCP) come in. TCP is used in conjunction with IP in order to maintain a connection between the sender and the target and to ensure packet order. For example, when an email is sent over TCP, a connection is established and a 3-way handshake is made. First, the source send an SYN "initial request" packet to the target server in order to start the dialogue. Then the target server then sends a SYN-ACK packet to agree to the process. Lastly, the source sends an ACK packet to the target to confirm the process, after which the message contents can be sent. The email message is ultimately broken down into packets before each packet is sent out into the Internet, where it traverses a series of gateways before arriving at the target device where the group of packets are reassembled by TCP into the original contents of the email. The primary version of IP used on the Internet today is Internet Protocol Version 4 (IPv4). Due to size constraints with the total number of possible addresses in IPv4, a newer protocol was developed. The newer protocol is called IPv6 and it makes many more addresses available and is increasing in adoption.

Application layer (OSI model)

provides application services to a network and advertises available services; file sharing, email, networked printers advertising that they are online; client software applications are not part of the application layer; rather the application layer is responsible for the protocols and data manipulation that the software relies on to present meaningful data to the user. Application layer protocols include HTTP as well as SMTP (Simple Mail Transfer Protocol is one of the protocols that enables email communications).

DDos Attack: Invisible Killers

small sized, short period of attack, often willfully ignored by service providers

Network Layer (3rd layer)

Defines how data packets are routed in a network. Accepts outgoing messages and combines messages or segments into packets, adding a header that includes routing information (provides a logical path for data)

Transport Layer (Layer 4)

Layer 4 is responsible for end-to-end communication between the two devices. This includes taking data from the session layer and breaking it up into chunks called segments before sending it to layer 3. The transport layer on the receiving device is responsible for reassembling the segments into data the session layer can consume. The transport layer is also responsible for flow control and error control. Flow control determines an optimal speed of transmission to ensure that a sender with a fast connection doesn't overwhelm a receiver with a slow connection. The transport layer performs error control on the receiving end by ensuring that the data received is complete, and requesting a retransmission if it isn't.

Session Layer (Layer 5)

OSI Layer: Responsible for managing and controlling the synchronization of data between applications. Performs connections between apps. The session layer also synchronizes data transfer with checkpoints. For example, if a 100 megabyte file is being transferred, the session layer could set a checkpoint every 5 megabytes. In the case of a disconnect or a crash after 52 megabytes have been transferred, the session could be resumed from the last checkpoint, meaning only 50 more megabytes of data need to be transferred. Without the checkpoints, the entire transfer would have to begin again from scratch.

OSI Model (Open Systems Interconnection)

OSI provides a standard for different computer systems to be able to communicate with each other. It is made up of seven layers: Application, Presentation, Session, Transport, Network, Data Link, Physical

Presentation Layer (Layer 6)

This layer is primarily responsible for preparing data so that it can be used by the application layer; in other words, layer 6 makes the data presentable for applications to consume. The presentation layer is responsible for translation, encryption, and compression of data.

Physical Layer (Layer 1)

This layer includes the physical equipment involved in the data transfer, such as the cables and switches. This is also the layer where the data gets converted into a bit stream, which is a string of 1s and 0s. The physical layer of both devices must also agree on a signal convention so that the 1s can be distinguished from the 0s on both devices.