Ask the Expert

Security loopholes in TCP/IP

What are the security loopholes in TCP/IP?


    Requires Free Membership to View

First, let's discuss just what TCP and IP are.

IP is the Internet Protocol. It is a protocol used to send packets of data, or datagrams, from one point to another with no sequencing of packets and no guarantee of delivery.

TCP is the Transport Control Protocol. It provides for sequencing of IP packets, requests retransmission of dropped packets, etc.

While those are rather simplistic descriptions, that is the real gist of what they do. Note that there is nothing about security in those descriptions.

So, there isn't any real security at all in TCP/IP, and there never was any intended. If you want confidentiality, you need to encrypt the data. If you want to know for sure who the sender or receiver of the data really is, you need to add an authentication service.

Steve Bellovin of Bell Labs wrote a paper detailing security problems with TCP/IP many years ago, and it is still a good reference paper for the subject.

CERT has also issued many advisories about problems with TCP/IP.


For more information on this topic, visit these other searchSecurity resources:
Ask the Expert: Security risks of TCP/IP
Security Policies Tip: Seven problem areas to monitor for AS/400-TCP/IP
Best Web Links: Infrastructure & Network Security


This was first published in February 2002

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: