6.1 Security Protocols

A security protocol is a set of rules and procedures that governs how data is transmitted securely over a network. Security protocols ensure authentication, encryption, and data integrity so that information cannot be intercepted, altered, or forged during transmission.

---

Why Security Protocols Matter

Without security protocols, data sent over the internet travels as plain text and can be read or modified by any attacker who intercepts it. Security protocols address three core goals — the CIA Triad:

---

Key Security Protocols

1. SSL / TLS (Secure Sockets Layer / Transport Layer Security)

• SSL was the original protocol; TLS is its more secure successor.
• Operates at the Transport/Application layer of the OSI model.
• Provides encrypted communication and server authentication between a web browser and a web server.
• Used in HTTPS — when you see a padlock icon in your browser, TLS is active.

2. HTTPS (Hypertext Transfer Protocol Secure)

• HTTP transmits data in plain text — vulnerable to eavesdropping and tampering.
• HTTPS wraps HTTP inside TLS/SSL, encrypting all data exchanged.
• Uses port 443 by default (HTTP uses port 80).
• Essential for login pages, banking, and any site handling sensitive data.

3. IPsec (Internet Protocol Security)

• Operates at the Network Layer (Layer 3) of the OSI model.
• Authenticates and encrypts every IP packet in a communication session.
• Commonly used in Virtual Private Networks (VPNs) to create secure tunnels over public networks.
• Because it works at Layer 3, it secures all applications running over IP — not just web traffic.

4. SSH (Secure Shell)

• Provides a secure, encrypted channel for remote command-line login and file transfer.
• Replaces older, insecure protocols such as Telnet and standard FTP, which transmit credentials in plain text.
• Uses port 22 by default.
• Widely used by network administrators for remote server management.

5. WPA2 / WPA3 (Wi-Fi Protected Access)

• Security protocols for wireless networks.
• WPA2 uses AES (Advanced Encryption Standard) for strong data encryption.
• WPA3 provides even stronger protection, especially on open networks.
• Replaced the older, weak WEP (Wired Equivalent Privacy) standard.

---

Usability vs. Security Trade-offs

A key concept in CS-12 is that stronger security often reduces usability:

When recommending cybersecurity measures, factors to consider include efficiency, cost, privacy, and ethics.

---

Summary Table