Q

Security loopholes in TCP/IP

What are the security loopholes in TCP/IP?


First, let's discuss just what TCP and IP are.

IP is the Internet Protocol. It is a protocol used to send packets of data, or datagrams, from one point to another with no sequencing of packets and no guarantee of delivery.

TCP is the Transport Control Protocol. It provides for sequencing of IP packets, requests retransmission of dropped packets, etc.

While those are rather simplistic descriptions, that is the real gist of what they do. Note that there is nothing about security in those descriptions.

So, there isn't any real security at all in TCP/IP, and there never was any intended. If you want confidentiality, you need to encrypt the data. If you want to know for sure who the sender or receiver of the data really is, you need to add an authentication service.

Steve Bellovin of Bell Labs wrote a paper detailing security problems with TCP/IP many years ago, and it is still a good reference paper for the subject.

CERT has also issued many advisories about problems with TCP/IP.


For more information on this topic, visit these other searchSecurity resources:
Ask the Expert: Security risks of TCP/IP
Security Policies Tip: Seven problem areas to monitor for AS/400-TCP/IP
Best Web Links: Infrastructure & Network Security


This was first published in February 2002

Dig deeper on Security Resources

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close