Chapter 5: Network Security Systems

IT IS SALIENT to explore the origins of the different types of Network Security Systems; whilst recognising that sometimes we have all types together in one combined system.

Security Defined

Evidently, we have three legitimate kinds of accessibility or Privacy Status (secret, private, open)—associated with three types of Access Protection (owner-restricted, single-copy-send, universal-send/receive).  Established is that, security—or protection of social accessibility status—is a time-bound property that must be provided by relevant security mechanism(s)—specifically: carefully designed human or manual working procedures (i.e. particular social structures, regulated human-human interaction(s), prescribed data communication events/formats, specific social processes etc); and also by means of:

Adequately secure automatic and semi-automatic systems—or the locking, blocking and concealment of primary, secondary, and tertiary network: system access gateway(s)/attack-surfaces.

Overall, security—or access protection—equates to management of a datum-copy’s form/content—existing on media of access, storage and transfer. Specifically, by one of the three methods identified: owner/user-restriction, single-copy-send, and universal-send/receive. The primary aim of security is to prevent legitimate secret-datums from morphing into illegitimate private or open datums; and also to prevent legitimate private datums from morphing onto illegitimate open datums. Finally, legitimate open-datum access must be rendered generally accessible—whereby one seeks to protect accessibility for anyone/everyone (ref. open-publication— see the companion book ‘Self as Computer’).

Now that we have developed a comprehensive definition of security, it is necessary to examine the environment(s) in which any particular datum-copy resides.

Fundamental Categories Of Computing Operations

Typically present are four Fundamental Categories of Computing Operation(s) as follows:

PROCESSING—deals with aspects of data: entry, gathering, movement, combination and transformation (local/remote);

STORAGE—deals with aspects of data permanence (local/remote);

PRESENTATION—deals with aspects of data connection, visibility and display (local/remote);

COMMUNICATION—deals with aspects of data transfer (remote).

Now for each of the four types of computer operation; a legitimate copy may be either A) secret; B) private or C) open. Ergo, there are (at least) twelve different kinds of protective techniques (or sub-system(s)) that may be required for any particular information security system. For example: secret and private items on a communication system—often require two different kinds of protection (however both may use some of the same techniques).

As stated, any related sub-system(s) are normally comprised of automatic, semi-automatic and manual operating procedures—and all of these must be managed appropriately (including interrelations/couplings etc)—and in order to provide effective protective security.

In the present site/book, we have only explored one of the twelve sub-system protection types: specifically defence of private datum-copies existing on a point-to-point communication system (whilst superficially considering related aspects of data storage and presentation wherever necessary).

Primary Network Design

The subject at hand is the design of a primary-network—with respect to the safe transfer of meaning between individual human beings.

Accordingly, we specify the component(s) of a nominal primary network’s data-processing stack; and with a view to obtaining absolute security for communicated datum(s) [ref. Absolute Security:TARGET]. A second goal of this section is to identify safe principles of design/operation—for a primary— network—and by means of logically consistent definitions, analysis and exposition.

Prior to getting into our topic in detail we must first establish some definitions as follows:

Attack Surface / Window

An attack-surface/attack-window is an exposed facet/ system entry-point for a datum-copy, existing on a primary-network’s data-processing stack, and which (potentially) facilitates unwarranted social access to a private datum-copy’s content and/or form [Axiom 43].

Attack Vector

An attack-vector is a specific data-processing path, existing on a primary-network’s data-processing stack—which (potentially) provides unwarranted social access to a private datum-copy’s content and/or form [Axiom 44].

Security System Exploit

An exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability (via a poorly-protected Access Gateway) in order to cause unintended or unanticipated behavior to occur on a computer system’s software, hardware, or something electronic.

Access Gateway

An access-gateway consists of one or more access-nodes and/or exposed attack-surface(s)/window(s)—for a primary, secondary or tertiary copy [Axiom 45]. The gateway is comprised of a group of hardware/software elements that together form an ‘entrance aperture’ for actor pathway(s).

The gateway may be—open or shut—visible or invisible— protected or unprotected—at any particular place/time— and for specific actor(s)/attack-vector(s)—and by means of access/locking mechanism(s).

Representation Aspects

We have characterised a datum-copy—as a representation consisting of three aspects: firstly the physical-representation (or encapsulating media of storage, transfer and access for the datum-copy); and secondly the virtual-representation (datum-copy in a storage, transfer, and/or access format); and finally the meaning-representation (a datum with metrical, descriptive and selectional layers).

All three representation layers/aspects are not-necessarily present/protected for a particular copy. For example, you can have a physical-representation—but no format (meaningless data). Or else a copy with encrypted metrical structure (i.e. locked + concealed); but no unusual descriptive structure(s), that also uses standard modeless structure(s)—hence no descriptive/selective protection.

Media Types

A storage-media is a bundle of hardware/software technologies that work together to form a memory system—and in order to persist a datum-copy’s form and content [Axiom 46]. Example types include: hard disc drives, solid state drives, optical drives, magnetic drives, and cloud storage systems like Dropbox, iCloud, and Google-Drive etc.

A transfer-media is a bundle of hardware/software technologies that work together to form a delivery system—and in order to send a datum-copy from a source-point to a destination-point [Axiom 47]. Example types include any data transfer system consisting of telecommunication components such as wired and/or wireless links, data channels etc; including low level protocols such as LAN, WAN, FTP, HTTP and high level protocols like email etc. The definition would include networked applications like DropBox, Google-Drive etc.

An access-media is a hardware/software system that enables an actor to see, know and/or change a copy’s form and/or content (e.g. a data-access terminal) [Axiom 48].

N.B. Real-world media are normally an amalgamation of all three media types—storage, transfer and access. However blending media types/functions unnecessarily can be a source of security problems. For example, any superfluous mixing of the transfer and storage functions—may lead to exposed datum-copies at undesirable place(s)/time(s). In our terms, it is a question of how best to preserve socially secure communication.



SCF 1.0 – InfoGraphic E

Attack Surface As Datum-Copy

Source: ‘The Science Of Cybersecurity’ (2017) – by Alan Radley

Network Attack Surfaces

In previous Chapters we emphasised the need to bring actor-coherence to a primary-network’s defences; and in terms of protecting the data-processing stack from the unwarranted activities of any unsafe-actors (i.e. automated and/or human ones).

Accordingly, it is useful to identify the specific features of a nominal attack-surface, which (in any way) relate to exposure of a private-datum’s form and/or content.

Copies and Attack-Surfaces

In this book, we have characterised all attack-surfaces as being (in one way or another) equivalent to an exposed datum-copy. In one respect—this is correct— and because any (successfully exploited) attack-surface must provide a pathway to a copy—and thus can be equated to an exposed facet of the copy—as it comes to exist on the communication system.

However in another sense—it is obvious that not all attack-surfaces are copies—for example system-logins (access-nodes), access-devices, plus exposed communication data and encryption keys etc—are all (potentially) illicit windows into the system that may allow an unsafe-actor to access a primary, secondary or tertiary copy.

Copy at-Rest / in-Transit

A datum-copy which is at-rest has a physical form that (normally) exists as an integrated unit of static information —because it has been memory ‘saved’ on an electronic storage media. Conversely, a datum-copy that is in-transit is moving (and possibly segmented) across a telecommunications line etc.

A physical-gateway de nes a set of possible entry-method(s) for ‘grasping’ a digital-copy; and examples include valid and invalid access-nodes (logins), illicit software CVE break-ins, (successful entry-method(s): viruses, trojans, hacking etc), plus stolen CDs, hard-drives, and computers etc; including any and all ways of obtaining access to the container—or outer form—of the copy.

Absolute Security

We can begin by characterising an attack-surface as equivalent to an exposed datum-copy (see Figure 5).

For absolute security, we must protect:

  1. Physical-Gateway(s)—who can obtain a physical copy.
  2. Virtual-Gateway(s)—who can open a virtual copy.
  3. Meaning-Gateway(s)—who can decode datum(s).

To be successful, an intruder must first pass through the physical and virtual gateway(s); prior to deciphering the meaning of the inner datum(s)—or passing through any meaning-gateway(s) that happen to be present [Axiom 50].

Obviously a variety of different kinds of primary-network designs are possible—each with a specific feature set; but which one is safest? In order to find out—we can take a step-by-step approach to protecting access-gateway(s) for a nominal network.

Protective Methods

In terms of securing physical-gateway(s)—or locking/ blocking/concealing—all access-gateways/pathways related to the copy’s physical representation—we can (perhaps) begin by eliminating all legitimate secondary-copies. This can be done by moving to a Peer-to-Peer (P2P) network (no central copies)—assuming that no other organisational/transfer/replicated copies exist on any secondary-network(s) (see later Chapters).

Next we can focus on removing any possibility of an unwarranted nth-party producing illegitimate secondary/ tertiary-copies. Here we rely on securing the datum’s content during live transport. Special line-encryption/packet-scrambling methods can be used (transport locks); in addition to moving the communication channel out-of-reach of an attacker—by means of closed physical and/or concealed virtual-gateway(s) (blocking/existence concealment). For example, we can use invisible/transitory access-node(s); secret protocol(s), private servers/ packet-routing mechanism(s); and/or employ covert access-device(s) with hidden/spoofed IP/MAC data.

Remaining is a single class of attack-surface—primary- copies. In some ways this type of attack-surface is the most difficult to protect; because an access-device/node is analogous to an armour reinforced bank vault. Whereby once an attacker is inside the vault—he/she (normally) has free access to all of the valuable items. Unfortunately there are many ways for an attacker to break into this type of ‘vault’—or access-node/device.

Normally we must rely on a mishmash collection of (protected) physical/virtual gateways provided by network administrators, system manufactures etc.

However due to the evolving nature of the risk; including newly discovered exploit(s), uncertain attack-vector(s) and countless hostile actor(s) etc; it is difficult to secure each access-node with full confidence over an extended period of time. One way to mitigate against such risk(s) is to move the access-node (plus associated private-copies/data-set(s))— beyond the reach of an attacker.

Ergo, we protect all entry-method(s)—with valid access control(s) plus advanced encryption—that is—by locking all virtual/meaning-gateways.

Another way is to move the same to a secure portable device—with hidden IP/MAC addresses (i.e. closing/ blocking/concealing all physical gateways).






SCF 1.0 – InfoGraphics J and K

Form and Meaning Gateway(s)

Source: ‘The Science Of Cybersecurity’ (2017) – by Alan Radley

Network Security Systems – Conclusion

In summary, access-gateways (for datum-copies) can be classified into three kinds: physical-gateways, virtual-gateways and meaning-gateways.

Ergo gateway defences are predicated upon one—or more—of the following factors:

  • Unbreakable (or strong) encryption/coding for copies;
  • Secure Entity/Access/ID: Management System(s);
  • ‘Stealth’ network design features.

All three predicates assume a primary-network with unimpeachable operations that provides socially secure communication for shared datum(s).

Ergo, we know what is required for absolute security—next we must prescribe how.