secure socket layer (ssl) & web security
TRANSCRIPT
Web Security & SSL
Akhil Nadh PC17203101 Mtech - 2017 ( IS )
NIT Jalandhar
Web Security, also known as “Cybersecurity” involves protecting that
information by preventing, detecting, and responding to attacks
Web Security: Terminologies
Hacker
Viruses
Worms
Trojan horses
Ransomware
KeyLoggers
Firewalls
Web Security: Aspects
Privacy
Integrity
Authentication
Web Security: Issues
<? phpmail(“[email protected]”, ”Hi from Bill Gates”, ”Hi, I amBill gates” , "From: [email protected]");
?>
From: [email protected]
Subject: Hi from Bill GatesHi, I am Bill gates
Web Security: Issues
Malicious websites
SPAM
Phishing
DDOS
How will you provide your customers safe and secure environment on your website ?
SSL (Secure Socket Layer)
Transport Layer Security Protocol Used to secure data between two
machines Online ID card ensures who they are
You May Know SSL
Pad Lock Browser bar turning Green https
Without SSL
Lets Fully Understand How SSL Works.
Bob is Business Owner He Owns bobsbike.bizHe wants people to be safe visiting hisWebsite
He need to apply for SSL Certificate From Web Hosting company or purchase online from third party Certificate Authority
[ VeriSign , GeoTrust , Comodo , Digicert ]
Suppose He calls VeriSign
• Research Company • Check the references • and postively determine they are who they are
SSL• Assures Identity • Encrypt data to and fro
When Customer internet browser connect with BOB Server• Check SSL is Valid• What type of Encryption and Scrabling they use
Now , Bob does not have to worry about loosing customers due to Performance Issues
Now , When Customer places Orders Sensitive Info is secured with SSL Certificate
Assured Safe and Legitimate Website
Customer Gets the BikeBob gets the PaymentAttacker gets NOTHING..!
SSL (Secure Socket Layer)
transport layer security service
originally developed by Netscape
version 3 designed with public input
uses TCP to provide a reliable end-to-end service
SSL has two layers of protocols
SSL Record Protocol
Handshake Protocol
Change Cipher Spec Protocol
Alert Protocol
HTTP
Two important SSL concepts
SSL Session:
is an association between a client and a server.
created by the Handshake Protocol.
define a set of cryptographic security parameters which can be shared among multiple connections.
are used to avoid the expensive negotiation of new security parameters for each connection
SSL Connection
A connection is a transport that provides a suitable type of service.
are peer-to-peer relationships
are transient.
Every connection is associated with one session.
SSL Architecture
SSL Handshake Protocol
allows server & client to:
authenticate each other
to negotiate encryption & MAC algorithms
to negotiate cryptographic keys to be used
comprises a series of messages in phases
1. Establish Security Capabilities
2. Server Authentication and Key Exchange
3. Client Authentication and Key Exchange
4. Finish
Thank You