Chapter 4. Techniques and Technologies for Information Security Assurance

Learning Objectives

01

Understand the overview of information security techniques and technologies

Identify security domains and representative technologies in each domain.

02

Master access control

Understand the definition, DAC, MAC, RBAC mechanisms, and common authentication technologies.

03

Analyze firewall types

Distinguish packet-filtering, application-level gateway, circuit-level gateway, and deployment models.

04

Understand IDS/IPS and intrusion detection techniques

Compare signature-based and anomaly-based detection; analyze the advantages and disadvantages of each method.

Table of Contents

1. Overview of information assurance techniques and technologies

3. Firewalls

Introduction to firewalls

Types of firewalls

Access control techniques

Firewall limitations

2. Access control

Access control concepts

Access control measures

Some access control technologies

4. Intrusion detection and prevention systems

Introduction

Classification

Intrusion detection techniques


5. Review questions

Overview of Techniques and Technologies for Ensuring Information Security

Areas of Information Security

Information security is not confined to a single technical field but spans many layers of protection. Each area uses specialized technologies, yet all are aimed at the same common goal: protecting the confidentiality, integrity, and availability of information.


Typical Techniques and Chapter Focus

Classification of Information Security Techniques and Technologies by Domain

Access Control

Access Control Concept

Access control is a mechanism that ensures only authorized subjects can interact with system resources. It is the foundation for protecting all three core attributes:

  • Confidentiality: Prevents unauthorized users from reading sensitive data.
  • Integrity: Only permitted users can modify data.
  • Availability: Ensures valid users can always access the resources they need.

Real-world examples

  • Students can only view their own grades on the university LMS.
  • Bank tellers can only access customer accounts assigned to them.
  • Employees can only read documents belonging to their department.

Components of an Access Control System

A complete access control system consists of three services that work closely together in a unified process:

Authentication

Verifies the authenticity of identification information. Example: checking a username and password.

Authorization

Determines which resources may be accessed based on policy and roles after successful authentication.

Administration

Foundational service. Adds, removes, and modifies accounts and permissions — supports both Authentication and Authorization, does not directly participate in the access flow but is indispensable.

Definition and Three Core Services

Access control (Access Control) is a set of mechanisms used to identify, authenticate, and authorize a subject when accessing information system resources. A complete access control system includes three core services:

Authentication

Verifies the identity of the subject: "Who are you?"

Uses passwords, biometrics, digital certificates, or tokens.

Authorization

Determines the privileges of the authenticated subject: "What are you allowed to do?"

Based on roles, policies, or specific permission lists.

Administration

Manages the lifecycle of accounts and access rights: "Who grants and revokes permissions?"

Includes account creation, role assignment, auditing, and logging.

Comparison of Authentication, Authorization, and Administration

These three components work sequentially and complement one another, forming a closed-loop access control system. Missing any one of them weakens the entire protection system.

Access Request Processing Flow

Every access request goes through a strict sequential process. The final result — grant or deny access — must be fully recorded in the system log for auditing.

Access Control Measures

Overview of Four Access Control Mechanisms

DAC: Discretionary Access Control

Key Characteristics

Discretionary Access Control (DAC) is a mechanism in which the resource owner has full authority to decide who can access it and at what permission level. This model is highly flexible but depends heavily on each user's security awareness.

  • The owner can freely grant or revoke access rights for others.
  • Permissions can be delegated further to another subject (delegation).
  • Risk: users may accidentally share too many permissions.

Real-world example

User A owns the folder /home/A/documents on Linux. User A can grant read permission to B, read/write permission to C, or deny access to everyone.

Command: chmod 750 documents

ACM: Access Control Matrix

Access Control Matrix (ACM) is a two-dimensional data structure that represents all access rights of every subject to every object in the system.

Access control matrix model

Advantages

  • Clear and comprehensive representation of all permissions.
  • Easy to check the rights of a specific subject.

Disadvantages

  • The matrix becomes sparse when the number of subjects and objects is large.
  • Difficult to scale and maintain in an enterprise environment.

ACM Example

ACL: Access Control List

Access Control List (ACL) is the practical implementation of DAC, in which each object stores a list of (subject, permission) pairs. The operating system checks the ACL whenever there is an access request.

File: BaoCao_Q4.xlsx

  • Alice: Read, Write
  • Bob: Read
  • Admin: Full Control
  • Everyone: Deny

How it works

When Bob sends a request to read the file, the operating system scans the ACL from top to bottom, finds the entry "Bob: Read" and allows the action. If Bob requests to write, no Write permission is found → denied.

ACL is the column-based simplification of ACM, organized by object instead of the entire matrix, helping save memory and making management easier.

ACL Example

  • ACL is managed by the operating system in both user space and kernel space
  • Each file such as F1, F2, F3... has its own ACL in that file's profile
  • The ACL stores pairs (subject, permission); subjects are A, B, C..., and permissions include R (read), W (write), X (execute)
  • Example F1(A: RW; B: R): A has read and write permission, while B has read permission only

Access control list model

Comparison of ACM and ACL

MAC: Mandatory Access Control

Operating Principle

Mandatory Access Control (MAC) does not let users decide access rights themselves. Instead, the system controls access based on two main factors:

  • Sensitivity level of the information (classification label): each object is assigned a security label.
  • Authorization level granted to the subject (clearance level): each user is granted a certain authorization level.

A subject can access an object only if the clearance level ≥ the object's classification label.

Security level hierarchy

  • Top Secret — Top secret
  • Secret — Secret
  • Confidential — Confidential
  • Unclassified — Unclassified

Applications: military environments, intelligence, central banks.

Bell-LaPadula Model

The "No Read Up" principle

A subject may only read documents with a classification at or below their clearance level. A lieutenant (Secret level) cannot read a Top Secret document from the general.

The "No Write Down" principle

A subject may only write to documents with a classification at or above their clearance level. A general cannot write Top Secret information into an Unclassified document — this prevents information from leaking to lower levels.

RBAC (Role-Based Access Control)

Core principle

Role-Based Access Control (RBAC) does not assign permissions directly to users, but through job roles. Users are assigned to one or more roles, and each role has a specific set of permissions.

Principle of least privilege: each role is granted only the minimum permissions necessary to perform its duties.

  • Easy to manage when personnel changes occur — only the role assignments need to be updated.
  • Well suited to an enterprise organizational structure.

Rule-based Access Control

Rule-based access control determines access rights through predefined rules, not based on user identity but on attributes of the access request.

Attributes used in rules

  • Source / destination IP address
  • Service port (Port 80, 443, 25…)
  • Domain name or URL
  • Keywords in content
  • File type or protocol

Firewall rule examples

  • Allow: HTTP (port 80), HTTPS (port 443)
  • Allow: SMTP (port 25) from mail server
  • Block: Websites with domain names on the banned list
  • Block: .exe files downloaded from untrusted sources

Some Access Control Technologies

Overview of Access Control Technologies

Each technology has its own strengths and limitations. In practice, high-security systems often combine two or more factors (Multi-Factor Authentication — MFA) to increase reliability.

Password-Based Access Control

Operating Mechanism

Password is the most common authentication factor. The system does not store passwords as plaintext, but instead stores hash values. When a user logs in, the system hashes the entered password and compares it with the stored value.

Factors that determine security:

  • Minimum length (≥ 12 characters)
  • Rich character set: uppercase, lowercase, numbers, special characters
  • Password policy: change periodically every 90 days
  • Do not reuse old passwords

Limitations to Note

  • Vulnerable to dictionary or brute force attacks if the password is weak.
  • Can be sniffed when transmitted over an unencrypted network.
  • Users tend to choose passwords that are easy to remember and easy to guess.
  • Phishing can steal passwords without cracking them.

Access Control Based on Cryptographic Keys / Digital Certificates

Mechanism and Components of a Digital Certificate

A public key certificate (Public Key Certificate) is an electronic document that verifies the identity of an entity and binds that identity to a public key. A digital certificate consists of three core components:

  • Subject: The identity of the certificate owner (domain name, organization).
  • Public Key: The certificate owner's public key.
  • CA Signature: The digital signature of the Certificate Authority (CA) confirming validity.

Practical Example: Banking HTTPS

The user sees a padlock icon in the browser, ensuring they are communicating with the real bank server, not a spoofed one.

Smartcard-Based Access Control

Two-Factor Authentication with Smartcard

Smartcard is a plastic card with an integrated processor and memory, capable of storing and processing cryptographic authentication information. Smartcard authentication is based on two combined factors:

  • Something you have: The physical card containing authentication information.
  • Something you know: The PIN used to activate the card.

An attacker must possess both the card and know the PIN to gain access — a higher level of protection than a password alone.

Smartcard Classification

  • Contact: Inserted directly into a reader. Examples: SIM cards, ATM cards.
  • Contactless: Communicates via RFID/NFC. Examples: office access cards, student cards tapped at the gate.

Token-Based Access Control

Token Characteristics

Token is a compact, dedicated device for authentication. Tokens can operate through two main mechanisms:

  • OTP Token (One-Time Password): Generates one-time codes, usually changing every 30–60 seconds. Example: RSA SecurID.
  • Storage Token: Stores cryptographic authentication information such as secret keys or digital certificates.

Applications and Evaluation

  • E-wallets: Software tokens integrated into mobile apps (Google Authenticator, Microsoft Authenticator).
  • Mobile payments: Encryption tokens replace the actual card number in transactions.

Advantages: OTP codes change continuously and cannot be reused if stolen.

Limitations: Costs to issue and manage hardware devices; they can be lost or damaged.

Biometric-Based Access Control

Fingerprint

Most common, integrated in phones and laptops. High accuracy, fast processing.

Face Recognition

Recognizes through a camera, no touch required. Used in access control and phone unlocking.

Iris / Retina

Very high accuracy, difficult to spoof. High equipment cost, often used in high-security environments.

Voice

Authentication through voice characteristics. Sensitive to noisy environments and can be spoofed with recordings.

Advantages

  • Tied to the rightful owner and cannot be transferred.
  • No need to remember or carry a physical object.
  • Harder to spoof than passwords or cards.

Limitations

  • High equipment investment cost.
  • Slower processing speed than passwords.
  • Recognition errors (FAR, FRR) and privacy concerns around biometric data.

Firewall

The Role of Firewalls in Defense-in-Depth

What is a firewall?

A firewall is a hardware or software device placed at the network boundary that controls the flow of traffic between network zones with different levels of trust.

Core principle

A firewall only allows traffic that is valid according to a set of rules to pass through. Any traffic that does not match the allowed rules is denied by default (default deny).

Firewall Introduction

A dedicated hardware firewall by Cisco

Concept, Placement, and Filtering Principles

Concept

A firewall is a network access control system that operates on the principle of filtering data packets based on a set of rules built according to an organization's security policy. A firewall can be:

  • Dedicated hardware: Router with integrated firewall, UTM device.
  • Software: Windows Firewall, iptables on Linux.
  • Virtualized (Virtual Firewall): In cloud environments.

Filtering Principles

Each incoming packet is checked against the rule list in priority order. The first matching rule determines the corresponding action (allow/deny).

Deployment Position Diagram

Internet (untrusted)

↓

Firewall (network gateway)

↓

DMZ (Web, Mail, DNS Server)

↓

Internal Firewall

↓

LAN (trusted internal network)

Firewall Deployment Models

Model 1: Single Firewall

Suitable for small networks. One firewall protects the entire internal system.

  • Internet → Firewall → LAN (servers + users)
  • Simple and easy to manage, but without separation of security zones.
  • If the firewall is breached, the entire system is exposed.

Model 2: Two Firewalls (DMZ)

Suitable for organizations with public-facing services (web, mail, DNS).

  • Internet → Outer firewall → DMZ (Web, Mail, DNS, FTP) → Inner firewall → LAN
  • The DMZ isolates public services from the internal network.
  • Even if the DMZ is compromised, the LAN is still protected by the second layer.


Firewall protecting a home or small office network

Firewall system protecting service servers and workstations

Types of Firewalls

Classification by Network Protocol Layer

Packet-Filtering Firewall

Operating layer: Network Layer (Layer 3)

Inspects each packet based on source/destination IP, port, and protocol. Does not care about connection state or content.

Example: Allows TCP packets to port 443, blocks all ICMP packets from outside.

Circuit-Level Gateway

Operating layer: Session Layer (Layer 5)

Checks the TCP handshake process (three-way handshake) to confirm a valid connection before allowing traffic through.

Example: SOCKS proxy blocks connections that have not completed the handshake.

Application-Level Gateway

Operating layer: Application Layer (Layer 7)

Understands application semantics (HTTP, FTP, SMTP), and can filter by content, URL, keywords, and application commands.

Example: Web proxy blocks URLs containing banned keywords; filters FTP PUT commands from outside.



Comparison of Firewall Types

Stateful and Stateless Firewalls

Stateless Firewall

Relies on source and destination addresses and fixed parameters to assess risk.

  • Rules must be configured in advance by the administrator
  • If a packet falls outside safe parameters → it is blocked or restricted

Stateful Firewall

Checks the entire packet content, characteristics, and communication channel.

  • Tracks and classifies behavior patterns — detects threats even if they have not been manually configured
  • Can be placed at the network edge or inside (ISFW) to protect individual segments

Case Study: Stateless vs. Stateful Firewall

Stateless Firewall (Cisco IOS ACL)

Requires 2 rules (inbound + outbound)

  • Rule 1 (Inbound): Source: Any → Destination: 192.168.1.100:443 — Allow
  • Rule 2 (Outbound): Source: 192.168.1.100:443 → Destination: Any — Allow

Stateful Firewall (pfSense)

Only 1 rule is needed

  • Rule 1 (Inbound): Source: Any → Destination: 192.168.1.100:443 — Allow

Case Study: Stateless vs. Stateful Firewall

Which Firewall Should You Choose?

The choice of firewall depends on the scale, budget, and level of complexity of the environment that needs to be protected.

Personal

  • Stateless: low cost, suitable for simple needs — but requires networking knowledge to configure rules
  • Stateful: more expensive but smarter, requires less complex configuration

Small Business

  • Prefer Stateless: budget-friendly, low traffic, simpler risk profile
  • Relatively easy to manage static rule sets

Large Business (Enterprise)

  • Stateful: dynamic filtering, adapts to new threats
  • Add a WAF (Web Application Firewall) for web-facing services to provide comprehensive application-layer protection

Firewall Access Control Techniques

Four Firewall Access Control Techniques

Service Control

Determines which Internet services are allowed to be accessed (inbound or outbound), based on IP address and port number.

Example: Allow only HTTP (80) and HTTPS (443); block FTP (21) from outside.

Direction Control

Determines the direction of traffic — inbound or outbound — before allowing a connection.

Example: Allow connections from inside to outside, block all connections from outside to the internal network.

User Control

Controls access based on the identity of authenticated users, often applied to internal users connecting remotely via VPN.

Example: Only IT staff are allowed to SSH into the management server.

Behavior Control

Controls how services are used — filtering spam, blocking malicious content, limiting bandwidth for specific services.

Example: Filter emails containing .exe attachments; block movie downloads from P2P networks.

Example: Building a Firewall Rule Set

The table below illustrates a practical firewall rule set for a system with a web server, mail server, and internal LAN:

The rules are evaluated from top to bottom in order of priority. The final rule (default deny) ensures that any traffic that does not match is denied.

Firewall Limitations

Key Limitations and Supplementary Solutions

Intrusion Detection and Prevention Systems

Introduction to IDS/IPS

IDS/IPS Concepts and Main Tasks

Definition

IDS (Intrusion Detection System) is a software or hardware system that monitors and analyzes network traffic or system behavior to detect signs of unauthorized intrusion, record logs, and send alerts.

IPS (Intrusion Prevention System) expands the functions of IDS by adding automatic prevention capability when dangerous behavior is detected.

Main Tasks

  • Continuously monitor network traffic or system behavior.
  • Detect signs of intrusion or unusual behavior.
  • Record complete security event logs for analysis.
  • Send alerts to administrators in real time.
  • (For IPS only) Automatically prevent: drop packets, block IPs, terminate connections.

Role of IDS/IPS in Network Protection

IDS — Detection and Alerting

Intrusion Detection System focuses on a passive monitoring role: analyzing traffic or behavior, detecting signs of abnormal activity, and sending alerts to administrators for response.

IPS — Prevention and Response

Intrusion Prevention System operates inline on the traffic path, with the ability to automatically block, drop packets, or terminate connections as soon as intrusion behavior is detected, without human intervention.

Placement of IDS and IPS systems in the network diagram

Comparison of IDS and IPS, Deployment Positions

IDS/IPS

IDS/IPS Classification

Classification by Data Source: NIDS and HIDS

NIDS — Network-based IDS

NIDS monitors traffic across an entire network segment by placing sensors at strategic points (network gateway, switch mirror port). It analyzes each packet that passes through.

  • Advantages: Broad monitoring, does not affect server performance.
  • Limitations: Cannot see end-to-end encrypted traffic; difficult to monitor in fully switched networks.
  • Typical tools: Snort, Suricata, Zeek (Bro).

HIDS — Host-based IDS

HIDS monitors behavior on each specific host: tracking system logs, configuration file changes, running processes, and executed commands.

  • Advantages: Detects attacks inside the host; can see activity after encryption.
  • Limitations: Consumes host resources; does not show the overall network picture.
  • Typical tools: OSSEC, Wazuh, Tripwire.

NIDS deployed to monitor intrusion detection at the gateway and for each network segment

Using a combination of NIDS and HIDS to monitor network traffic and hosts


Classification by Analysis Method

In addition to being classified by data source, IDS/IPS are also classified by analysis method for intrusion detection. There are two main approaches:

Signature-based Detection

Compares current traffic or behavior with a database of known attack patterns. Highly effective against familiar attacks but cannot detect new attacks (zero-day).

Anomaly-based Detection

Builds a profile of normal system behavior, then alerts when it detects a significant deviation from that profile. Can detect new attacks but has a higher false positive rate.

Intrusion Detection Techniques

Signature-Based Detection

How it works

Signature-based detection relies on a database of attack signatures — characteristic patterns of malicious behavior that have been recorded and classified. The IDS matches each segment of traffic or system event against this database.

Simple signature example

Snort rule for detecting a SYN port scan:

alert tcp any any -> $HOME_NET any (flags:S; msg:"SYN Scan Detected"; threshold:type both, track by_src, count 20, seconds 1; sid:1001;)

Flowchart for signature-based intrusion detection monitoring

Advantages and Disadvantages of Signature-Based Detection

Anomaly-Based Detection

Two Main Phases

Anomaly-based detection operates in two separate phases: building a normal behavior profile and then detecting significant deviations from that profile.

  • Training phase: Collect traffic / behavior data under normal conditions and build a statistical or machine-learning model that characterizes "normal" behavior.
  • Detection phase: Compare current behavior with the trained profile. If the deviation exceeds the threshold → trigger an alert.

Entropy values of source IPs from legitimate traffic (high, uniform values) and entropy of source IPs from DDoS attack traffic (low values)

Example: Source IP Entropy for DDoS Detection

Idea explanation

In normal traffic, source IPs are highly diverse → entropy is high (~3.5–4.0 bits). When a DDoS attack occurs from a small number of sources (a concentrated botnet), source IPs repeat continuously → entropy drops sharply to near 0.

The anomaly-based IDS detects the sudden entropy drop at T5 and raises a DDoS alert even though this is an attack type not present in the signature database.

Comparison of Signature-Based and Anomaly-Based Detection

Review Questions

Review Questions: Access Control and Firewalls

Access Control

  1. What is access control? Name the three core services and the role of each service.
  1. Compare DAC and MAC: the basis for granting permissions, who makes the decision, and typical application environments.
  1. Which two principles does the Bell-LaPadula model use to protect confidentiality? Explain and give examples.
  1. How is RBAC different from DAC and MAC? Why is RBAC well suited for business environments?
  1. Compare ACM and ACL: advantages, disadvantages, and why ACL is more widely used.
  1. Name five authentication technologies and compare the authentication factor, security level, and usability.

Firewalls

  1. What is a firewall? Explain its role in a defense-in-depth model.
  1. Differentiate packet-filtering, circuit-level gateway, and application-level gateway by operating layer and filtering mechanism.
  1. How is a stateful firewall different from a stateless firewall? When should each type be used?
  1. Describe four firewall access control techniques and give an example of each.
  1. Present two firewall deployment models. Why does the two-firewall model provide better protection?
  1. List at least four limitations of firewalls and propose suitable complementary solutions.

Review Questions: IDS/IPS and Intrusion Detection Techniques

IDS/IPS

  1. How are IDS and IPS similar and different in terms of function, placement, and level of intervention?
  1. What are NIDS and HIDS? Compare their monitoring scope, advantages, and limitations.
  1. Why can inline IPS create a single point of failure (SPOF)? How can this risk be mitigated?

Intrusion Detection Techniques

  1. Describe the signature-based detection process and give a specific signature example.
  1. How many stages does anomaly-based detection include? Describe each stage.
  1. Why can anomaly-based detection identify zero-day attacks but also produce a high false-positive rate? Explain based on how it works.
  1. Explain the example of source IP entropy in DDoS detection. Why is a sudden drop in entropy a sign of abnormal activity?