Network Security, Privacy and Trust

Introduction and Context

Advanced communication networks are no longer isolated infrastructures. They interconnect cloud platforms, mobile devices, industrial controllers, satellites, autonomous systems, Internet of Things devices, and human users across administrative boundaries. Consequently, security is not a peripheral operational concern: it is a design property of the network, its protocols, devices, applications, and governance processes.

Network security seeks to preserve confidentiality, integrity, availability, authenticity, and accountability. Privacy extends this concern to the lawful and ethical collection, use, disclosure, retention, and deletion of information about identifiable or linkable individuals. Trust concerns the degree to which an entity, system, credential, or decision can be relied upon under specified conditions. These goals can conflict. For example, extensive logging may improve accountability but increase privacy risk; strong inspection may improve detection but expose sensitive content; and availability mechanisms may enlarge the attack surface.

This chapter develops an integrated approach to threat modeling, cryptography, authentication, access control, secure protocols, network defense, zero-trust architecture, privacy, compliance, and incident response.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Construct a threat model using assets, actors, attack surfaces, trust boundaries, and security objectives.

2. Distinguish symmetric cryptography, public-key cryptography, hashing, digital signatures, and key-establishment mechanisms.

3. Design authentication and authorization architectures using federation, least privilege, and policy enforcement.

4. Explain the security roles and limitations of IPsec, TLS, VPNs, firewalls, intrusion detection, and DDoS defenses.

5. Apply zero-trust principles and evaluate secure routing choices.

6. Analyze privacy, regulatory, ethical, and incident-response requirements.

7. Critically evaluate security controls through an applied network-security scenario.

1. Security Foundations and Threat Modeling

1.1 Security objectives

Confidentiality prevents unauthorized disclosure. Integrity protects data and system behavior from unauthorized alteration. Availability ensures that authorized users can access services when required. Authenticity establishes that an entity, message, or service is genuine. Accountability links actions to responsible entities through reliable records, while non-repudiation provides evidence that a party performed an action; in practice, non-repudiation depends on legal, procedural, and technical controls rather than on a signature alone.

A security requirement should be stated operationally. “The network must be secure” is too vague. A stronger requirement is: “Only authenticated members of the research group may retrieve experiment data, and every retrieval must be logged for 180 days.” Such a statement identifies a subject, action, resource, condition, and evidence requirement.

1.2 Threat modeling

Threat modeling is a structured method for anticipating how a system could be compromised. It normally proceeds through:

• Asset identification: data, credentials, services, devices, safety functions, intellectual property, and reputation.
• Architecture representation: data-flow diagrams, interfaces, trust boundaries, dependencies, and administrative domains.
• Adversary characterization: capability, motivation, access, persistence, resources, and legal status.
• Threat enumeration: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege are a useful initial classification.
• Risk evaluation: estimate likelihood and impact, then prioritize controls.
• Control selection and validation: choose preventive, detective, corrective, and compensating controls and test them.

Risk assessment should not be treated as a precise prediction. A qualitative matrix is useful for prioritization, but likelihood estimates may be uncertain and correlated. A high-impact, low-probability threat to a safety-critical system may deserve priority over a frequent but low-impact event.

Attack trees express how an attacker can achieve a goal through alternative or simultaneous conditions. Abuse cases describe harmful use of a legitimate function. STRIDE is useful for software-oriented threat enumeration, while the cyber kill chain and MITRE ATT&CK are useful for mapping adversary behavior and detection opportunities. No framework is complete; the model must be adapted to the system and its threat environment.

1.3 Trust boundaries and attack surface

A trust boundary is a point where assumptions about identity, authority, data quality, or administrative control change. Examples include an API gateway, a cloud tenancy boundary, a wireless-to-wired transition, and a management-plane interface. The attack surface includes reachable interfaces, exposed services, software dependencies, credentials, physical access points, and human processes. Reducing attack surface through segmentation, removal of unnecessary services, secure defaults, and timely patching is generally more reliable than attempting to detect every attack.

2. Cryptographic Foundations

2.1 Symmetric cryptography

Symmetric algorithms use a shared secret key for encryption and decryption. Modern authenticated encryption with associated data (AEAD), such as AES-GCM or ChaCha20-Poly1305, provides confidentiality and integrity for a message while allowing selected metadata to remain unencrypted but authenticated. A nonce or initialization value must be used according to the algorithm specification; catastrophic failures can result from nonce reuse, especially with GCM.

Symmetric cryptography is computationally efficient and suitable for bulk traffic. Its principal operational difficulty is secure key distribution and lifecycle management. Keys require generation from an approved random source, controlled storage, rotation, revocation where applicable, backup protection, and eventual destruction.

2.2 Hashes and message authentication

A cryptographic hash maps an input to a fixed-length digest. Security properties include preimage resistance, second-preimage resistance, and collision resistance. Hashes are used for integrity references, password-verifier constructions, signatures, and content addressing. A hash alone does not authenticate a sender: an attacker who can replace both a file and its hash can defeat a simple comparison.

A message authentication code (MAC), such as HMAC, combines a secret key with a message and produces an authenticator. It provides integrity and origin authentication to parties possessing the key, but it does not provide public verifiability or non-repudiation.

Passwords should not be stored as ordinary hashes. A password-verification system should use a memory- or computation-hard password hashing function such as Argon2id, with a unique salt per password and parameters selected through performance testing. Encryption of a password database is not a substitute for password hashing because a compromised decryption key could reveal all passwords.

2.3 Public-key cryptography and signatures

Public-key systems use a public key and a mathematically related private key. They support digital signatures, certificate-based authentication, and key establishment. A signature is generated with a private key and verified with the corresponding public key. It provides integrity and evidence of key possession, provided that the private key is protected and the public-key binding is trustworthy.

Public-key cryptography does not remove the need for trust management. A certificate authority (CA) issues certificates binding identities to public keys under defined validation rules. Certificate chains, expiration, revocation mechanisms, key usage constraints, and secure CA operations are essential. Elliptic-curve systems can provide strong security with relatively small keys, but implementations must use approved curves, libraries, and side-channel protections.

2.4 Key establishment and forward secrecy

Authenticated key exchange allows parties to establish a shared session key over an untrusted network. Ephemeral Diffie–Hellman methods provide forward secrecy when fresh session secrets are used: compromise of a long-term authentication key should not by itself reveal recorded past sessions. Forward secrecy does not protect a session whose endpoints are compromised during communication, nor does it prevent endpoint logging of plaintext.

Cryptographic strength also depends on implementation. Weak random-number generation, incorrect certificate validation, insecure key storage, downgrade paths, and unverified library changes can defeat mathematically sound algorithms. “Using encryption” is therefore an insufficient security claim.

3. Identity, Authentication and Access Control

3.1 Authentication factors and federation

Authentication establishes identity or a sufficiently strong claim about it. Factors include knowledge, possession, inherence, and contextual or behavioral evidence. Multi-factor authentication (MFA) should combine independent factors; two passwords are not two factors. Phishing-resistant methods, including hardware-backed passkeys using public-key credentials, are preferable to reusable passwords and many one-time codes.

Identity federation allows one identity provider to authenticate users for multiple relying services. SAML and OpenID Connect are common federation technologies, while OAuth 2.0 primarily provides delegated authorization rather than user authentication. Correct audience validation, redirect-URI control, token expiry, scope restriction, and protection of signing keys are necessary. Federation improves usability and central governance but creates concentration risk: compromise of the identity provider can affect many services.

3.2 Authorization models

Authentication answers “who or what is this?” Authorization answers “what may it do?”

• Discretionary access control permits resource owners to grant permissions.
• Mandatory access control applies centrally defined classifications and clearances.
• Role-based access control assigns permissions to organizational roles.
• Attribute-based access control evaluates attributes such as identity, device posture, location, data classification, and time.
• Capability-based approaches grant possession of an unforgeable authority to perform specified actions.

Least privilege grants only the permissions necessary for an approved task. Separation of duties prevents one individual or component from completing a sensitive process alone. Privileges should be time-limited, reviewed, and revoked when no longer required. Administrative access should use separate privileged accounts, strong authentication, command logging, and controlled workstations.

4. Secure Network Protocols and Architecture

4.1 TLS

Transport Layer Security protects application traffic between endpoints. A TLS handshake negotiates protocol parameters, authenticates a server through a certificate, and establishes traffic keys. TLS 1.3 reduces legacy cryptographic options and normally provides forward secrecy through ephemeral key exchange. Certificate validation must verify the chain, name, validity period, key usage, and relevant policy. Disabling validation to “make the connection work” converts encryption into an unauthenticated tunnel.

TLS protects traffic in transit between the TLS endpoints. It does not automatically protect data after termination at a reverse proxy, from malicious code on an endpoint, or from an authorized but abusive administrator. Mutual TLS can authenticate both client and server and is useful for service-to-service communication, but certificate issuance and workload identity management become operational responsibilities.

4.2 IPsec and VPNs

IPsec operates at the network layer. Authentication Header provides integrity and origin authentication but is rarely used for general confidentiality; Encapsulating Security Payload supports confidentiality, integrity, and authentication. Transport mode protects the payload of an IP packet, whereas tunnel mode encapsulates the original packet and is common for gateway-to-gateway VPNs. Internet Key Exchange negotiates security associations and keys.

A VPN provides a protected path, not a complete security architecture. A compromised endpoint can send malicious traffic through a VPN, and broad network access after VPN login violates least privilege. Modern remote access should use device posture checks, per-application access where feasible, MFA, logging, and rapid revocation. Site-to-site VPNs must also address routing, overlapping address spaces, failover, key rotation, and split-tunnel policy.

4.3 Firewalls and segmentation

Packet-filtering firewalls evaluate addresses, ports, protocols, interfaces, and connection state. Next-generation systems may add application identification, user context, and content inspection. Web application firewalls focus on HTTP-layer attacks but cannot replace secure application development.

A defensible architecture separates public services, user networks, management systems, databases, operational technology, and sensitive research assets. Segmentation limits lateral movement and reduces blast radius. However, excessive complexity can produce undocumented exceptions and unsafe operational workarounds. Rules should be explicit, justified by business requirements, ordered predictably, reviewed, monitored, and removed when obsolete.

5. Detection, DDoS Defense and Secure Routing

5.1 Intrusion detection and response

Network intrusion detection systems inspect traffic or metadata for signatures, protocol violations, and anomalous behavior. Host-based systems observe processes, files, and logs. Signature detection is effective for known patterns but weak against novel attacks; anomaly detection can identify deviations but produces false positives and may be evaded by low-and-slow behavior. Detection quality depends on sensor placement, time synchronization, data quality, baseline validity, and analyst capability.

Security information and event management systems correlate events across identity, endpoint, network, and cloud sources. Automated response should be proportionate: isolating a confirmed compromised host may be appropriate, whereas automatically blocking an unusual but legitimate research flow may disrupt critical work. Detection engineering should define the behavior of interest, required telemetry, analytic logic, validation method, and response owner.

5.2 DDoS defense

Distributed denial-of-service attacks consume bandwidth, connection state, application resources, or expensive computation. Defenses include capacity planning, rate limiting, connection controls, caching, anycast distribution, upstream filtering, scrubbing services, and resilient application design. The correct control depends on the attack layer. A large volumetric attack cannot normally be solved by an on-premises firewall if the access link is already saturated. Emergency runbooks should specify provider contacts, diversion procedures, evidence collection, communication responsibilities, and restoration criteria.

5.3 Secure routing

Routing security protects the control plane and prevents unauthorized path announcements or manipulation. BGP security practices include prefix filtering, route-origin validation using the Resource Public Key Infrastructure, maximum-prefix limits, monitoring of route changes, and authenticated peer sessions where supported. Origin validation reduces some forms of route hijacking but does not by itself validate the entire AS path. Routing security also requires management-plane protection, configuration control, redundancy, and tested rollback procedures.

6. Zero-Trust Architecture

Zero trust rejects implicit trust based solely on network location. A request is evaluated using identity, device state, application, resource sensitivity, session context, and policy. The commonly expressed principles are verify explicitly, use least privilege, and assume breach.

A zero-trust design separates a policy decision point from policy enforcement points. The decision process may consult identity, endpoint security, risk signals, and resource policy; the enforcement point permits, denies, limits, or continuously re-evaluates the session. Microsegmentation, workload identity, just-in-time privileges, strong telemetry, and encrypted service communication are common implementation techniques.

Zero trust is not a product or a license to ignore network controls. It requires accurate asset inventories, dependable identity, policy quality, endpoint visibility, usable workflows, and governance. Poorly designed continuous verification can create surveillance, latency, availability, and administrative burdens. Access decisions should be explainable and regularly tested.

7. Privacy, Compliance and Trust Governance

Privacy engineering incorporates data protection during system design. Important practices include data minimization, purpose limitation, retention limits, pseudonymization, access transparency, user rights processes, and privacy-preserving defaults. Pseudonymized data may remain personal data when re-identification is reasonably possible; anonymization claims therefore require careful technical and contextual analysis.

Network telemetry can contain IP addresses, device identifiers, location, behavioral patterns, message metadata, and content. Organizations should define the purpose and lawful basis for collection, restrict access, protect logs, document retention, and avoid collecting content merely because storage is inexpensive. Differential privacy can reduce disclosure in aggregate statistics by adding calibrated randomness, but it involves a privacy–utility trade-off and requires careful accounting across repeated analyses.

Compliance obligations vary by jurisdiction and sector. Frameworks and laws may address breach notification, critical infrastructure, payment data, health information, personal data, records, and cross-border transfers. Compliance is not equivalent to security: a compliant organization may still be vulnerable, while a strong technical control may require additional legal safeguards. Governance should assign responsibility, maintain risk registers, conduct supplier assessments, and test controls rather than relying on policy documents alone.

Ethically, security teams must consider proportionality, consent, discrimination, accessibility, and the consequences of automated decisions. Monitoring employees or citizens without necessity and transparency can undermine legitimate trust. Responsible vulnerability disclosure and coordinated remediation are preferable to concealment or indiscriminate publication of exploit details.

8. Incident Response and Recovery

Incident response commonly includes preparation; detection and analysis; containment; eradication; recovery; and post-incident learning. Preparation includes inventories, contact lists, playbooks, backups, forensic readiness, legal coordination, and exercises. During analysis, responders preserve evidence, establish a timeline, determine scope, and distinguish indicators from confirmed facts.

Containment may be short-term, such as blocking command-and-control traffic, and long-term, such as rebuilding systems in a clean environment. Eradication removes persistence and root causes. Recovery restores services gradually while monitoring for recurrence. Post-incident review should identify control, process, and decision failures without turning the process into blame allocation.

Evidence handling requires accurate time sources, documented collection, integrity protection, access control, and a chain of custody where legal proceedings are possible. Communications should be truthful, coordinated, and sensitive to regulatory notification deadlines. Backups must be isolated from ordinary administrative credentials and tested through restoration exercises; an untested backup is an assumption, not a recovery capability.

9. Applied Case: Illustrative University Research Network

Background

A university operates a research network containing laboratory instruments, student laptops, cloud collaboration services, and a sensitive biomedical dataset. Remote researchers initially receive broad VPN access to the laboratory subnet. A central identity provider authenticates users with passwords and optional one-time codes. Network logs are retained indefinitely.

Problem

An attacker obtains a researcher’s password through phishing. The attacker logs in through the VPN, scans laboratory devices, finds an unpatched instrument gateway, and uses it to reach a file server. The attacker downloads data over several days. The university detects unusual outbound traffic but cannot quickly determine which records were accessed because logs are incomplete and timestamps differ between systems.

Analysis

The threat model identifies the dataset, instrument availability, identity provider, VPN gateway, file server, and research continuity as critical assets. Trust boundaries exist at the identity provider, VPN, laboratory subnet, cloud service, and instrument gateway. The principal weaknesses are password dependence, broad post-authentication access, inadequate segmentation, unpatched legacy equipment, excessive and poorly governed data retention, and weak detection telemetry.

Approach

The university adopts phishing-resistant MFA for researchers and administrators, separates administrative accounts, and introduces device certificates and posture checks. A zero-trust access proxy grants access to specific applications rather than the entire laboratory subnet. The instrument gateway is isolated in a restricted segment, with tightly controlled management paths. Critical data is encrypted at rest and in transit, and access is authorized through roles plus attributes such as project membership and device state.

Centralized logging uses synchronized clocks, defined retention periods, protected storage, and alerts for unusual downloads. Network detection monitors scanning, new external destinations, and abnormal service-account behavior. The incident-response plan includes identity-token revocation, credential reset, forensic imaging, notification assessment, and restoration from verified backups. Researchers receive training based on realistic workflows rather than generic annual instruction.

Outcome

The architecture reduces the consequences of a stolen password, limits lateral movement, improves evidence quality, and makes data access more attributable. It does not eliminate risk: a compromised authorized endpoint, malicious insider, or vulnerable instrument remains possible. Periodic access reviews, patch compensating controls, tabletop exercises, and independent testing are therefore retained.

Learning points

Security control effectiveness is systemic. MFA alone would not have solved broad VPN authorization; segmentation alone would not have solved stolen credentials; and indefinite logging would not guarantee useful evidence. Defense in depth, privacy-aware telemetry, and practiced response must be designed together.

10. Challenges, Limitations and Contemporary Directions

Legacy operational technology may not support modern cryptography or agents. Encrypted traffic reduces content visibility for traditional inspection, requiring endpoint telemetry, metadata analysis, and privacy-conscious monitoring. Cloud and multi-tenant systems shift responsibility among providers and customers, making configuration errors a major concern. Supply-chain compromise can enter through software dependencies, firmware, managed services, or update channels.

Artificial intelligence can assist alert triage, malware classification, behavioral analysis, and attack-path discovery. It can also generate false confidence, expose sensitive training data, be manipulated through adversarial inputs, and accelerate phishing or exploit development. AI-based controls require representative evaluation, human oversight, traceability, secure model supply chains, and explicit privacy governance.

Post-quantum cryptography is being standardized because sufficiently capable quantum computers could threaten widely used public-key algorithms. Migration requires inventorying cryptographic dependencies, prioritizing long-lived confidential data, designing crypto-agility, and avoiding improvised algorithms. Symmetric cryptography is affected differently and generally requires key-size and implementation analysis rather than a simple replacement rule.

Best practice is therefore lifecycle-oriented: establish security requirements; model threats; minimize exposure; authenticate strongly; authorize narrowly; encrypt correctly; monitor proportionately; rehearse response; measure outcomes; and improve after evidence-based review.

Chapter Summary

Network security is an integrated discipline concerned with confidentiality, integrity, availability, authenticity, accountability, privacy, and trust. Threat modeling identifies assets, adversaries, boundaries, and attack paths so that controls can be prioritized. Symmetric encryption protects bulk data, public-key cryptography supports authentication and key establishment, hashes support integrity constructions, and authenticated encryption prevents tampering when correctly implemented. Identity federation, MFA, least privilege, separation of duties, and attribute-aware authorization reduce misuse.

TLS and IPsec protect communications at different layers, while VPNs, firewalls, segmentation, intrusion detection, DDoS controls, and secure routing address distinct parts of the attack surface. Zero-trust architecture replaces implicit network trust with continuous, context-aware policy decisions. Privacy requires minimization, purpose limitation, controlled retention, and ethical monitoring. Compliance supports governance but does not replace engineering. Effective incident response depends on preparation, evidence quality, coordinated containment, tested recovery, and learning. No individual technology is sufficient; resilient security results from layered controls, sound governance, and continuous adaptation.

Key Terms

Threat modeling: Structured analysis of assets, threats, vulnerabilities, risks, and controls.

Attack surface: The reachable interfaces and conditions through which a system may be attacked.

Trust boundary: A point where security assumptions or administrative control change.

AEAD: Authenticated encryption with associated data, providing confidentiality and integrity.

Cryptographic hash: A fixed-length digest designed to provide specified one-way and collision properties.

MAC: A keyed authenticator providing message integrity and origin authentication to key holders.

Digital signature: A public-key operation used to verify integrity and private-key possession.

Forward secrecy: Protection of past sessions from later compromise of long-term keys.

Certificate authority: An entity that issues and manages public-key certificates.

Authentication: Verification of an identity claim.

Authorization: Determination of permitted actions on resources.

Least privilege: Granting only the access necessary for an authorized task.

Federation: Use of an identity provider to authenticate users for relying services.

IPsec: A suite of network-layer security protocols.

VPN: An authenticated and protected logical communication path over another network.

Zero trust: An architecture that grants no implicit trust based on network location.

DDoS: Distributed denial-of-service attack using multiple sources to impair availability.

Pseudonymization: Replacing direct identifiers while retaining a controlled possibility of linkage.

Incident response: Organized detection, containment, eradication, recovery, and learning after an incident.

Review Questions

Short Answer Questions

1. What are the principal security objectives of a communication network?

2. Why is a cryptographic hash alone insufficient for authenticating a message sender?

3. Distinguish authentication from authorization.

4. What is the purpose of forward secrecy?

5. Why does a VPN not, by itself, implement zero trust?

Long Answer Questions

1. Explain a complete threat-modeling process and discuss the limitations of qualitative risk matrices.

2. Compare symmetric encryption, public-key cryptography, MACs, hashes, and digital signatures in terms of purpose and key management.

3. Compare TLS, IPsec, VPNs, firewalls, and segmentation as layers of a secure network architecture.

4. Explain zero-trust architecture, including policy decision, enforcement, identity, device posture, and least privilege.

5. Discuss privacy engineering, compliance, ethical monitoring, and incident response as governance responsibilities.

Analytical / Application Questions

1. A university grants all authenticated VPN users access to an entire laboratory subnet. Design a revised architecture using threat modeling, MFA, segmentation, and application-level authorization.

2. During a DDoS attack, an organization’s Internet link becomes saturated before its firewall can filter traffic. Analyze why the local firewall is insufficient and propose an operational defense plan.

3. A security team wants to retain all user network content indefinitely to improve incident investigation. Evaluate this proposal from security, privacy, legal, ethical, and technical perspectives.

Multiple Choice Questions with Answers

Question 1

Which control primarily provides confidentiality and integrity for bulk network traffic when correctly implemented?

A. A cryptographic hash without a key

B. Authenticated encryption with associated data

C. A public certificate without a private key

D. A firewall rule permitting all traffic

Correct Answer: B. Authenticated encryption with associated data

Question 2

What is the main security purpose of a unique salt in password storage?

A. To enable plaintext password recovery

B. To make every password database entry identical

C. To reduce the effectiveness of precomputed guessing attacks

D. To replace the need for a slow password-hashing function

Correct Answer: C. To reduce the effectiveness of precomputed guessing attacks

Question 3

Which statement about OAuth 2.0 is most accurate?

A. It is primarily a delegated authorization framework

B. It is a replacement for all cryptographic algorithms

C. It is a network-layer routing protocol

D. It guarantees that a user’s endpoint is uncompromised

Correct Answer: A. It is primarily a delegated authorization framework

Question 4

Which property is associated with ephemeral key exchange?

A. Automatic availability during a volumetric DDoS attack

B. Forward secrecy when long-term keys are later compromised

C. Removal of the need for certificate validation

D. Permanent encryption of endpoint logs

Correct Answer: B. Forward secrecy when long-term keys are later compromised

Question 5

In IPsec, tunnel mode generally

A. protects only a password database

B. encapsulates the original IP packet within another packet

C. operates exclusively at the application layer

D. eliminates the need for routing

Correct Answer: B. encapsulates the original IP packet within another packet

Question 6

Which principle is central to zero-trust architecture?

A. Trust every device inside the corporate network

B. Grant broad access after a single VPN login

C. Verify explicitly and apply least privilege

D. Disable all monitoring to preserve privacy

Correct Answer: C. Verify explicitly and apply least privilege

Question 7

Why may an on-premises firewall fail to stop a large volumetric DDoS attack?

A. The firewall cannot inspect any IP packet

B. The access link may be saturated before traffic reaches the firewall

C. DDoS attacks affect only application passwords

D. Firewalls operate only on encrypted payloads

Correct Answer: B. The access link may be saturated before traffic reaches the firewall

Question 8

Which measure best limits lateral movement after compromise of one network segment?

A. Network segmentation with restrictive inter-segment policies

B. Indefinite retention of unprotected logs

C. A single shared administrator password

D. Disabling time synchronization

Correct Answer: A. Network segmentation with restrictive inter-segment policies

Question 9

Which statement about pseudonymized data is correct?

A. It is always anonymous and outside privacy regulation

B. It cannot be linked under any circumstances

C. It may remain personal data if re-identification is reasonably possible

D. It must be published to demonstrate transparency

Correct Answer: C. It may remain personal data if re-identification is reasonably possible

Question 10

Which activity belongs primarily to the recovery phase of incident response?

A. Establishing an asset inventory before incidents

B. Rebuilding affected services from verified clean sources

C. Enumerating possible adversaries during design

D. Issuing a certificate to every user

Correct Answer: B. Rebuilding affected services from verified clean sources