6.7 Security Protocols | Impacts Of Computing | Computer Science 12

A security protocol is a set of rules and procedures that governs how data is securely transmitted, authenticated, and protected across a network. Security protocols are the backbone of safe digital communication.

The CIA Triad

All security protocols are designed to uphold one or more pillars of the CIA Triad:

Pillar	Meaning
Confidentiality	Only authorized parties can access the data
Integrity	Data is not altered or tampered with during transmission
Availability	Authorized users can access data and systems when needed

Key Security Protocols

1. HTTP vs. HTTPS

Feature	HTTP	HTTPS
Full Name	Hypertext Transfer Protocol	Hypertext Transfer Protocol Secure
Data Transmission	Plain text (unencrypted)	Encrypted via SSL/TLS
Default Port	80	443
Security	Vulnerable to interception	Protected from eavesdropping
Use Case	Non-sensitive pages	Login pages, banking, e-commerce

When you see a padlock icon in your browser's address bar, the site is using HTTPS.

2. SSL / TLS

SSL (Secure Sockets Layer) — the original protocol for encrypting web traffic (now deprecated).
TLS (Transport Layer Security) — the modern, more secure successor to SSL.
Function: Creates an encrypted tunnel between a web server and a browser, ensuring data remains private and tamper-proof.
Used in: HTTPS, email (SMTPS), VoIP, and more.

3. IPsec (Internet Protocol Security)

A suite of protocols that secures IP communications by authenticating and encrypting each IP packet.
Operates at the Network Layer of the OSI model.
Commonly used in: Virtual Private Networks (VPNs) to create secure tunnels over the public internet.
Protects data in transit between two network endpoints.

4. SSH (Secure Shell)

Provides secure remote login and command execution over an unsecured network.
Replaces insecure protocols like Telnet and rlogin.
Uses strong encryption and public-key authentication.
Used by: System administrators to manage servers remotely.

5. WPA2 / WPA3 (Wi-Fi Security)

WEP (Wired Equivalent Privacy) — the original Wi-Fi security standard, now considered weak and broken.
WPA2 (Wi-Fi Protected Access 2) — uses AES (Advanced Encryption Standard) for strong wireless encryption.
WPA3 — the latest standard, offering even stronger encryption and protection against brute-force attacks.
Used in: Securing home and enterprise Wi-Fi networks.

Security vs. Usability Tradeoffs

Implementing strong security protocols often comes with tradeoffs:

Factor	Consideration
Efficiency	Encryption adds processing overhead, potentially slowing systems
Cost	SSL/TLS certificates and VPN infrastructure have financial costs
Privacy	Stronger protocols better protect user data
Usability	Extra authentication steps (e.g., certificates, VPN login) can frustrate users
Ethics	Organizations have an ethical duty to protect user data with appropriate protocols

For example, requiring IPsec VPN for all remote access is highly secure but may reduce productivity if the connection is slow. Choosing the right protocol requires balancing these factors.

Summary Table

Protocol	Purpose	Layer	Common Use
HTTPS	Secure web browsing	Application	Websites, banking
SSL/TLS	Encrypted communication channel	Transport/Session	HTTPS, email
IPsec	Secure IP packet transmission	Network	VPNs
SSH	Secure remote access	Application	Server management
WPA2/WPA3	Secure wireless networks	Data Link	Wi-Fi security

Pillar

Meaning

Confidentiality

Only authorized parties can access the data

Integrity

Data is not altered or tampered with during transmission

Availability

Authorized users can access data and systems when needed

Key Security Protocols

Feature	HTTP	HTTPS
Full Name	Hypertext Transfer Protocol	Hypertext Transfer Protocol Secure
Data Transmission	Plain text (unencrypted)	Encrypted via SSL/TLS
Default Port	80	443
Security	Vulnerable to interception	Protected from eavesdropping
Use Case	Non-sensitive pages	Login pages, banking, e-commerce

When you see a padlock icon in your browser's address bar, the site is using HTTPS.

SSL (Secure Sockets Layer) — the original protocol for encrypting web traffic (now deprecated).

TLS (Transport Layer Security) — the modern, more secure successor to SSL.

Function: Creates an encrypted tunnel between a web server and a browser, ensuring data remains private and tamper-proof.

Used in: HTTPS, email (SMTPS), VoIP, and more.

A suite of protocols that secures IP communications by authenticating and encrypting each IP packet.

Operates at the Network Layer of the OSI model.

Commonly used in: Virtual Private Networks (VPNs) to create secure tunnels over the public internet.

Protects data in transit between two network endpoints.

Provides secure remote login and command execution over an unsecured network.

Replaces insecure protocols like Telnet and rlogin.

Uses strong encryption and public-key authentication.

Used by: System administrators to manage servers remotely.

WEP (Wired Equivalent Privacy) — the original Wi-Fi security standard, now considered weak and broken.

WPA2 (Wi-Fi Protected Access 2) — uses AES (Advanced Encryption Standard) for strong wireless encryption.

WPA3 — the latest standard, offering even stronger encryption and protection against brute-force attacks.

Used in: Securing home and enterprise Wi-Fi networks.

Security vs. Usability Tradeoffs

Implementing strong security protocols often comes with tradeoffs:

Factor	Consideration
Efficiency	Encryption adds processing overhead, potentially slowing systems
Cost	SSL/TLS certificates and VPN infrastructure have financial costs
Privacy	Stronger protocols better protect user data
Usability	Extra authentication steps (e.g., certificates, VPN login) can frustrate users
Ethics	Organizations have an ethical duty to protect user data with appropriate protocols

For example, requiring IPsec VPN for all remote access is highly secure but may reduce productivity if the connection is slow. Choosing the right protocol requires balancing these factors.

Summary Table

Protocol	Purpose	Layer	Common Use
HTTPS	Secure web browsing	Application	Websites, banking
SSL/TLS	Encrypted communication channel	Transport/Session	HTTPS, email
IPsec	Secure IP packet transmission	Network	VPNs
SSH	Secure remote access	Application	Server management
WPA2/WPA3	Secure wireless networks	Data Link	Wi-Fi security