-: SSL and TLS provide the backbone of web security.
We've already talked a lot about SSL and TLS
every time we've talked about HTTPS,
but we're going to cover a couple more details
inside of this lesson.
First, SSL and TLS, what are they?
Well, SSL stands for the Secure Socket Layer
and TLS stands for Transport Layer Security.
These are cryptographic protocols
that provide secure internet communications
for web browsing, instant messaging, email, VoIP,
and many other services.
I know we talk a lot about it in web browsing,
but it can be used for all of these other things too.
Now, when we talk about SSL and TLS,
let's start with SSL because it's the older protocol.
SSL was what was created first.
It was a way to start securing the web
as we wanted to start doing e-commerce.
The last time SSL was updated though was 1996
with SSL version three.
It's really old.
You shouldn't use SSL.
Instead, it's been replaced by TLS,
Transport Layer Security.
Now, everyone watching this should be using TLS version 1.3,
which is the latest and greatest
right now as of this filming.
Now, often you're going to hear people call it SSL
even if it's TLS that you're using.
This is just something that people call incorrectly
because it's a creature of habit.
They've been using SSL since the '90s
and if you're an old guy like me,
you've been using it this whole time
and you call it secure socket layer
as opposed to transport layer security.
Whether you hear somebody say SSL or TLS,
most of the time, they're really referring to TLS.
Now, we already covered how TLS and SSL work
when we talked about the PKI lesson.
We talked about, if you remember, the web browser goes out
and gets the server's public key.
It then takes that and encrypts a random string of numbers,
sends that over to the web server.
Once the web server gets it,
they decrypt it using their private key.
They then create a symmetric tunnel between the two.
That symmetric tunnel, that is SSL or TLS.
Most of the time, it's TLS.
Now, again, that's because TLS is what's current and new
and that's what you should be using.
So we've already talked about how this works,
but I want to talk about how it can be used
with different protocols.
The first one is HTTPS, which we were just discussing.
Now, TLS operates below these other protocols.
For example, if you want to run a secure website,
you would tunnel the normal HTTP protocol
through a TLS tunnel.
Normally, you'd use HTTP over port 80,
but when you tunnel it through SSL or TLS,
you're going to end up putting it on port 443,
which is secure HTTP or HTTPS.
Next, let's talk about emails.
Let's say I wanted to send an email to you.
Normally, I'm going to use SMTP and send it over port 25.
But if I want to do that securely,
I want to establish a TLS tunnel first.
I'll establish that TLS tunnel over port 465 instead
and send my SMTP traffic through that tunnel.
Again, it's the same thing we did with web,
but now we're doing it with email
and you can do that for instant messaging.
You can do it for file transfer.
You could do it for all sorts of stuff.
Now, one of the things we have to be concerned with
with TLS is how people can attack it.
And one of the most common ways people attack it
is by doing a downgrade attack.
A downgrade attack is when a protocol is tricked
into using a lower quality version
instead of using the higher quality version
that it was supposed to.
So if your server was set up
to be able to use version 1.2 of TLS,
but somebody has their browser report
that they only support 1.0,
your server may downgrade itself to 1.0,
which is a weaker protocol and can be exploited.
Now, why does it work that way?
Well, if somebody connects to your website originally,
the first thing that your web server
and that client does is negotiate how they're going to talk.
And if I say to you, "Hey, I only talk at version 1.0,
and you want to be able to support me,
you're going to downgrade to 1.0."
To stop this, you can configure your web server
to not support downgraded versions and say,
"We're only going to support version 1.1 or 1.2," for example.
This is a configuration you can make inside your server
and check your server documentation,
whether it's Windows or Linux,
on how to do this specifically as you get into the field.
For the Security+ exam,
you need to understand the concept of downgrade,
not how to actually secure it,
by doing the hands-on keyboard type of stuff.
The last thing I want to mention about TLS
is while it is great and provides us lots of security,
as network defenders, it's actually a challenge for us.
Let me use this example.
You're sitting at your computer at work
and you decide to get on Dropbox.
Well, if you're on Dropbox
and you're using the secure version of that website,
you have a nice TLS connection from your device
all the way to Dropbox's servers.
Well, guess what?
Whenever you're putting files into there, as a defender,
I can't see what you're doing
because there's this tunnel that I'm not a part of
and so it's going to be secure from your computer,
your laptop, all the way to the server.
Well, if I need to see
what's coming in and out of the network,
I have to have a way to do that
and the way I do that is what's called break and inspect.
We talked about this back in web proxies.
If I can act as the man in the middle
by putting a proxy there,
you connect to the proxy, the proxy connects to Dropbox.
Now you're going to authenticate with the proxy
with a TLS tunnel,
then I'm going to unencrypt what you gave me,
I'm going to look at it, inspect it,
and then I'm going to encrypt it again
and send it off through a secure tunnel
all the way to Dropbox.
And when files come back, I can do the same thing.
This is how I can determine
what's coming in and out of my network
and looking at it and making sure there's no malware
or any bad things coming in or out.
Now, by doing this,
I'm going to end up eating up a lot of processor resources
because I have to decrypt and encrypt
every single thing that's going through
that break and inspect proxy.
And so when you set this up,
you have to make sure you set it up right.
And if you have a really large organization,
it gets really hard to do this effectively.