Antiquated Computer Protocols

Introduction

Transmission Control Protocol/Internet Protocol (TCP/IP) is a collection of several related protocols that together function to provide connectivity with the Internet and similar networks. Large enterprise networks to the small home office use TCP/IP on a daily basis.
First developed in the late 1970s, the TCP and IP protocols had gone through many changes and revisions, until the “first modern versions of these two key protocols were documented in 1980 as TCP version 4 and IP version 4” (Kozierok, 2005). TCP/IP has been in use since then, and over the course of time, the suites of protocols contained within TCP/IP have been updated over and over due to security vulnerabilities that have been discovered. The older protocols can provide a pathway for attack from cybercriminals.

Antiquated Protocols

An old protocol contained in TCP/IP is Telnet. Telnet is actually older than TCP/IP by almost a decade! The first written proposal of the Telnet protocol was published in February 1971. Telnet works by enabling a computer terminal to remotely access a server to run programs on that server over a network. The problem with older protocols such as Telnet is they “transmit data and passwords over the network in plain text. This means that the data and passwords can be intercepted and read by other users on the network” (MSP Communications, 2013).
The Secure Shell (SSH) protocol suite is a software solution to deal with the security ramifications of the open and prone-to-attack Telnet protocol. SSH was developed in 1995 by Tatu Ylönen, a researcher at the Helsinki University of Technology in Finland, after being the victim of a password-sniffing attack earlier that year. Ylönen wrote SSH to authenticate the legitimacy of the client and server along with all of the data, user accounts and passwords in an encrypted format as it travels along the network while not being apparent to the user.
Another old protocol contained in TCP/IP is File Transfer Protocol (FTP). A written proposal for FTP was published two months after Telnet, in April 1971. FTP has been the standard protocol used to transfer files between remote computers for quite a long time (ftpguide.com, 2008). But, FTP also suffered from a lack of security as commands, accounts, passwords, and data are sent in clear text that could be easily read by anyone intercepting network packets that were captured. To secure file transfers, a method known as FTP Secure (FTPS) was developed to safeguard data as it travels from one point to another. To use FTPS,
a connection to a server is established with Transport Layer Security and Secure Sockets Layer or TLS/SSL. The data is encrypted to protect the connection between a computer and its server which protects the user account, password and data. The encryption secures the data even if it is captured as data travels over a network.

Conclusion

Antiquated protocols’ original design was not for security, but to facilitate the process of communication between people or devices. Years ago, security was not an issue when scientists and librarians were using inter-connected computers. Early on in the Internet’s history, “research scientists came up with the ideas that allowed them to individually dream of and eventually come together to create a globally interconnected set of computers through which everyone could quickly and easily access data and programs from any site” (Elon University School of Communications, Year Unknown). The early internet was a stunning idea of brilliant minds coming together to collaborate for the benefit of humanity. Unfortunately, the Internet has been polluted and perverted with the parasites that attack networks and people for profit. Luckily, measures have been taken to update old, unsecure protocols. In addition to these industry standards updates, organizations must educate and train technology personnel to recognize and replace improperly configured equipment as a preventative measures against attackers.

“Users need training in the importance of securing information, the roles that they
play in security, and the steps they need to take to ward off attacks. Because new attacks
appear regularly and new security vulnerabilities are continuously being exposed, training must be ongoing”.