5Security implementation

• 5.1Secure protocols

  Covers IPsec (transport/tunnel mode, ESP/AH, IKE) for network-layer encryption and authentication, SSL/TLS (the handshake and TLS 1.3) at the transport layer, STARTTLS for upgrading a plaintext protocol to encryption, SSH for protecting remote operations, HTTPS for protecting the web, S/MIME for encrypting and signing email, and WPA2/WPA3 for wireless LANs, building the judgment to select the right protocol for a given communication requirement.

• 5.2Email/DNS security and authentication protocols

  Covers sender domain authentication for anti-spoofing—SPF, DKIM, and DMARC—and how their roles divide, spam countermeasures SMTP-AUTH and OP25B/IP25B, DNSSEC against DNS cache poisoning and DNSBL for identifying spam sources, the authorization standard OAuth, and the user-authentication protocols EAP/EAP-TLS/PEAP, RADIUS, and PSK used for wireless LANs and beyond—all from the perspective of which countermeasure is effective against which threat.

• 5.3Network security implementation

  Covers the fundamentals of perimeter defense—packet filtering and stateful inspection—the application gateway that inspects communication content, address translation via NAT/IP masquerading, per-device authentication via authentication VLAN, remote-access VPN (reverse proxy/port forwarding/L2 forwarding), DHCP snooping against rogue DHCP servers, MAC address filtering, and reconnaissance via port scanning—building judgment for selecting the right approach to a given perimeter-defense requirement.

• 5.4Secure OS, database, and application security

  Covers OS-level mandatory access control (MAC), RBAC, least privilege, and trusted OS, database encryption and DB access control, building security in from upstream via security by design/privacy by design/threat modeling, secure programming, vulnerability-detection techniques SAST/DAST/IAST/SCA, the web isolation principles Same Origin Policy/CORS, password protection via salting/stretching, and countermeasures for buffer overflow/XSS/SQL injection—all from the perspective of choosing the right implementation/detection technique to avoid or catch a given vulnerability.