Download Network Security and Secure Software Development: Study Notes and more Schemes and Mind Maps Information Security and Markup Languages in PDF only on Docsity!
Notes on Network Security Fundamentals
and Secure Software Development
Study Notes
May 14, 2025
Contents
1 Network Security Fundamentals........................ 2 1.1 Network Security Basics........................... 2 1.2 Firewalls..................................... 2 1.3 Virtual Private Networks (VPNs)...................... 3 1.4 Intrusion Detection and Prevention Systems (IDS/IPS)......... 3
2 Secure Software Development......................... 4 2.1 Secure Coding Practices........................... 4 2.2 Common Vulnerabilities........................... 5 2.3 Secure Software Development Lifecycle (SDLC)............. 5
3 Conclusion...................................... 6
1 Network Security Fundamentals
Network security is about protecting computer networks from unauthorized ac- cess, attacks, and data theft. It ensures that data sent over a network is safe, only authorized users can access it, and the network stays up and running. This section covers the basics of network security, firewalls, VPNs, and intrusion de- tection/prevention systems (IDS/IPS).
1.1 Network Security Basics
Networks connect computers, servers, and devices to share data. Without se- curity, hackers can steal data, disrupt services, or damage systems. Network security uses tools and techniques to keep networks safe.
- Why It’s Important : Networks handle sensitive information like passwords, financial data, or personal details. Security prevents data leaks and ensures privacy.
- Key Goals : - Confidentiality : Only authorized people can see the data. - Integrity : Data isn’t changed or tampered with during transfer. - Availability : The network is always accessible to legitimate users.
- Common Threats : - Malware : Viruses or ransomware that infects devices. - Phishing : Fake emails or websites tricking users into sharing informa- tion. - Denial of Service (DoS) : Attacks that overload networks to make them crash.
- Example : A company uses network security to protect customer data from hackers trying to steal credit card details.
1.2 Firewalls
A firewall is like a gatekeeper for a network. It checks incoming and outgoing traffic based on rules to allow or block data packets.
- How It Works : Firewalls filter traffic by IP addresses, ports, or protocols. For example, a firewall can block all traffic from an untrusted IP.
- Types of Firewalls : - Hardware Firewalls : Physical devices placed between a network and
- Intrusion Detection System (IDS) : Watches network traffic and alerts ad- ministrators about potential threats. Example: Snort.
- Intrusion Prevention System (IPS) : Goes further by actively blocking threats. Example: Suricata.
- How They Work : They analyze traffic patterns and compare them to known attack signatures or unusual behavior.
- Practical Use : Set up Snort to detect unauthorized login attempts on a server.
- Example : A bank uses an IPS to block a hacker trying to exploit a known vulnerability in its network.
- Best Practices : - Keep IDS/IPS signatures updated to detect new threats. - Place IDS/IPS at key network points, like between the internet and in- ternal servers. - Review alerts regularly to avoid false positives.
2 Secure Software Development
Secure software development means building software that’s safe from attacks. It involves writing secure code, avoiding common vulnerabilities, and following a secure development process to ensure software is reliable and protected.
2.1 Secure Coding Practices
Secure coding means writing programs in a way that prevents hackers from ex- ploiting them.
- Input Validation : Always check user inputs to ensure they’re safe. For example, if a form expects a number, reject letters or special characters.
- Use Safe Libraries : Use trusted libraries like Python’s sqlalchemy for database queries instead of writing raw SQL.
- Avoid Hardcoding Secrets : Don’t put passwords or API keys directly in code. Use environment variables instead.
- Error Handling : Show generic error messages to users (e.g., “Something went wrong”) instead of detailed errors that hackers can use.
- Example : In a web app, validate email inputs to ensure they follow the format [email protected].
- Best Practices : - Follow coding standards like OWASP Secure Coding Guidelines. - Use tools like linters to catch security issues in code. - Train developers on secure coding regularly.
2.2 Common Vulnerabilities
Software vulnerabilities are weaknesses that hackers can exploit. Two common ones are SQL injection and Cross-Site Scripting (XSS).
- SQL Injection : - What It Is : Hackers insert malicious SQL code into input fields (e.g., login forms) to manipulate databases. - Impact : Can steal data, delete records, or bypass login systems. - Example : A hacker enters ’ OR ’1’=’1 in a login form to gain unau- thorized access. - Prevention : Use prepared statements or parameterized queries in code. Example: In Python, use sqlalchemy to safely query databases.
- Cross-Site Scripting (XSS) : - What It Is : Hackers inject malicious scripts into web pages that run in users’ browsers. - Impact : Can steal cookies, redirect users, or display fake content. - Example : A hacker injects into a comment section. - Prevention : Sanitize user inputs and escape special characters (e.g., convert < to <) using libraries like html.escape in Python.
- Other Vulnerabilities : Weak passwords, insecure file uploads, or unpatched software can also be exploited.
- Best Practices : Regularly scan code with tools like SonarQube to find vul- nerabilities.
2.3 Secure Software Development Lifecycle (SDLC)
The SDLC is a process for building software from planning to maintenance. A secure SDLC includes security at every step to create safe software.
