Overview of Common Information Security Techniques: Network, System, and Cryptography

Information Security Overview

Programmers often face the myth that they must master every aspect of computer security, but a solid understanding of key security concepts can greatly improve development practices and reduce vulnerabilities.

Network Security

SQL Injection

SQL injection exploits insufficient input validation by inserting malicious SQL statements into query parameters, allowing attackers to read, modify, or delete database data.

select name, [...] from t_user where id=$id

When a request such as GET /userinfo?id=1%20or%201=1 is sent, the resulting query returns all rows, leaking data.

Defense: Validate and sanitize all inputs before constructing SQL statements.

Cross‑Site Scripting (XSS)

XSS injects executable JavaScript into web pages, enabling attackers to run arbitrary code in a victim's browser.

Types:

Reflected XSS – payload is delivered via URL parameters.

Stored XSS – payload is saved on the server (e.g., in a forum post) and later rendered.

Defense: Perform strict content filtering on both client and server sides.

CSRF (Cross‑Site Request Forgery)

CSRF tricks a logged‑in user’s browser into sending unintended requests to a trusted site, exploiting the automatically attached authentication cookies.

Defense: Use anti‑CSRF tokens and verify the origin of requests.

DDoS (Distributed Denial of Service)

DDoS overwhelms a service with massive traffic from many sources, rendering it unavailable.

Defense: Deploy traffic‑scrubbing services, SYN cookies, and rate‑limiting mechanisms.

DNS Hijacking

Attackers manipulate DNS responses to redirect users to malicious IP addresses.

Mitigation includes DNSSEC validation and using secure DNS services such as httpDNS.

TCP Hijacking

By predicting or sniffing TCP sequence numbers, an attacker can inject packets into an existing TCP session.

Defense: Use encrypted protocols (TLS) and enable TCP security extensions.

Port Scanning

Port scanners probe target hosts to discover open services, serving as a reconnaissance step for further attacks.

Defense: Restrict unnecessary ports and employ firewalls to block scanning attempts.

System Security

Stack Overflow

Overflowing a stack buffer overwrites the return address, allowing execution of attacker‑controlled code.

Defense: Enable stack canaries (e.g., Linux) or /GS (Windows) and write safe code.

Integer Overflow

Incorrect handling of integer limits can wrap values, leading to buffer overflows or logic errors.

+1: 0000 0000 0000 0001
-1: 1111 1111 1111 1111

Defense: Perform range checks and use safe arithmetic libraries.

Null‑Pointer Dereference

Using an uninitialized or freed pointer causes crashes and potential code execution if the address 0 is mapped.

Use‑After‑Free

Accessing memory after it has been freed can lead to arbitrary code execution when the allocator reuses the same region.

Hooking

Hook techniques intercept API calls or function entries to alter program flow, used by both malware and security software.

Privilege Escalation

Exploiting kernel or OS vulnerabilities to obtain higher privileges (e.g., admin/root) enables broader system compromise.

Trusted Computing

Trusted Execution Environments (TEE) such as ARM TrustZone isolate sensitive code from the main OS, providing hardware‑rooted security.

Cryptography

Symmetric & Asymmetric Encryption

Symmetric encryption uses the same key for encryption and decryption (e.g., AES, DES), while asymmetric encryption uses a public/private key pair (e.g., RSA, DH, ECC) to securely exchange keys.

Key Exchange

Protocols like Diffie‑Hellman enable two parties to derive a shared secret over an insecure channel.

Hash Functions

Hash algorithms (MD5, SHA‑1, SHA‑256) produce fixed‑size digests for data integrity verification.

Data Encoding

Base64 and other encodings transform binary data into printable characters for safe transmission.

Multi‑Factor Authentication

Combining passwords with biometrics (fingerprint, iris, facial recognition) or hardware tokens enhances login security.

Conclusion

Understanding these information‑security techniques is valuable for developers, operations, and security engineers alike, enabling them to build more resilient software and systems.