The Network Security Test Lab: A Step-by-Step Guide

CHAPTER 6 Automating Encryption and Tunneling Techniques

This chapter takes an in-depth look at cryptographic systems and methods used to obscure traffic. This is an important topic because everyone deals with encryption in one form or another. Encryption is a component of everyday life, from the websites you visit that are HTTPS to the encryption you may have on your cell phone and it’s even used in the Blu-ray disks you receive from Netflix. As a security professional, you should understand the ways in which attackers exfiltrate data and hide their activities.

For anyone involved in security, it is important to understand the basics of cryptographic systems. This includes symmetric and asymmetric encryption, and Public Key Infrastructure (PKI). Understanding how these systems work provides the building blocks for analyzing systems that security engineers work with, including identification and authentication systems. Authentication can be based on passwords, tokens, or biometrics. Regardless of how the activity or authentication is performed, some cryptographic processes are probably involved. As an example, if an encrypted password is used, consider how the password is encrypted. Is it some form of hashing algorithm or is a salt applied? Knowing these details will help you assess how strong the system is and what potential weaknesses the system may have.

At some point in your career as a security professional, you may also have to deal with a security breach, or an instance ...