slide1 n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
MORLEY Chapter 4: Network and Internet Security PowerPoint Presentation
Download Presentation
MORLEY Chapter 4: Network and Internet Security

Loading in 2 Seconds...

play fullscreen
1 / 71

MORLEY Chapter 4: Network and Internet Security - PowerPoint PPT Presentation


  • 116 Views
  • Uploaded on

MORLEY Chapter 4: Network and Internet Security. “Computer Spies Breach Fighter-Jet Project” – Wall Street Journal. F-35 Lightning II. Overview. This chapter covers: Security concerns stemming from the use of computer networks

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'MORLEY Chapter 4: Network and Internet Security' - tuari


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
overview
Overview

This chapter covers:

Security concerns stemming from the use of computer networks

Safeguards and precautions that can be taken to reduce the risk of problems related to these security concerns

Personal safety issues related to the Internet

Ways to protect against personal safety issues

Legislation related to network and Internet security

why is network and internet security important
Why is Network and Internet Security Important?

Security concerns related to computer networks and the Internet abound

Computer crime (cybercrime): Any illegal act involving a computer, including:

Theft of financial assets

Manipulating data for personal advantage

Act of sabotage (releasing a computer virus, shutting down a Web server)

All computer users should be aware of security concerns and the precautions that can be taken

unauthorized access and unauthorized use
Unauthorized Access and Unauthorized Use

Unauthorized access: Gaining access to a computer, network, file, or other resource without permission

Unauthorized use: Using a computer resource for unapproved activities

Codes of conduct: Used to specify rules for behavior, typically by a business or school

unauthorized access and unauthorized use 2
Unauthorized Access and Unauthorized Use, 2

Hacking: Using a computer to break into another computer system

A serious threat for individuals, businesses, and the country (national security)

Often performed via wireless networks today

Many wireless networks are left unsecured

War driving: Driving around an area to find a Wi-Fi network to access and use without authorization

unauthorized access and unauthorized use 3
Unauthorized Access and Unauthorized Use, 3

Wi-Fi piggybacking: Accessing an unsecured Wi-Fi network from your current location without authorization

Interception of communications: Messages, files, logon information etc. can be intercepted if not secured

protecting against unauthorized access and use
Protecting Against Unauthorized Access and Use

Access control systems: Used to restrict entry to:

Facilities

Computer networks

Databases

Web site accounts

Can be:

Identification systems: Verify that the person trying to access the facility or system is an authorized user

Authentication systems: Determine if the person is who he or she claims to be

access control systems
Access Control Systems
  • Possessed knowledge -- Use information that only an individual should know
  • Possessed object – Use a physical object in his/her possession to identify that individual
  • Biometric – Use unique biological characteristic(s) to identify an individual
possessed knowledge access control methods
Possessed Knowledge Access Control Methods

Usernames

Passwords

Use a strongpassword (letters, numbers, symbols)

Change it frequently

PIN (Personal identification number), ex, ATMs

Cognitive authentication systems: Use personal information the individual knows (birthplace, pet names, etc.)

Used in many password recovery systems

Disadvantages: Can be forgotten or stolen

most common passwords on the internet
Most Common Passwords on the Internet
  • password (Unchanged)
  • 123456 (Unchanged)
  • 12345678 (Unchanged)
  • abc123 (Up 1)
  • qwerty (Down 1)
  • monkey (Unchanged)
  • letmein (Up 1)
  • dragon (Up 2)
  • 111111 (Up 3)
  • baseball (Up 1)
  • iloveyou (Up 2)
  • trustno1 (Down 3)
  • 1234567 (Down 6)
  • sunshine (Up 1)
  • master (Down 1)
  • 123123 (Up 4)
  • welcome (New)
  • shadow (Up 1)
  • ashley (Down 3)
  • football (Up 5)
  • jesus (New)
  • michael (Up 2)
  • ninja (New)
  • mustang (New)
  • password1 (New)
possessed object access control methods
Possessed Object Access Control Methods

Magnetic card – code in magnetic stripe

Smart card – computer chip in card

RFID-encoded badge – RFID in card

USB security key or e-token

Disadvantages: Can be lost or stolen

biometric access control methods
Biometric Access Control Methods

Prints of finger(s), hand, face, iris, voice, etc.

Data scanned by biometric reader must match what is stored in a database

Often used:

To control access to secure facilities

To log on to computers, punch in/out at work, law enforcement, etc.

Advantages: Can only be used by the authorized individual and cannot be lost or forgotten

Disadvantages: Cannot be reset; expensive (cheap ones can be fooled)

two factor authentication systems
Two-Factor Authentication Systems
  • Require two different ID methods
    • Possessed knowledge (something you know)
    • Possessed object (something you have)
    • Biometric (something you are)
  • One-Time Password (OTP) tokens are an example
wi fi access control
Wi-Fi Access Control

In general, Wi-Fi is less secure than wired networks

Security is usually off by default; wireless networks should be secured

Wireless network owners should:

Enable encryption (Wi-Fi Protected Access (WPA) is more secure than WEP)

WEP – 40-bit key

WPA – 128-bit key

MAC Address Filtering – (Media Access Control), a 12-digit hardware ID (6 groups of 2 hexadecimal digits)

The original MAC address comes from the original Xerox Ethernet addressing scheme.

This 48-bit address space contains potentially 248 or 281,474,976,710,656 possible MAC addresses.

Not broadcast the network name (SSID)

Enable other security features as needed

ways to protect against unauthorized access and use
Ways to Protect Against Unauthorized Access and Use

Firewall: Hardware and/or software designed to protect a computer or computer network from attack

Intrusion prevention system (IPS): Monitors traffic to try and detect possible attacks

More of a myth than actual implementation…

Encryption: Scrambling contents of e-mail or files to make them unreadable if intercepted

A form of converting data into a cypher

Private key encryption (symmetric)

Public key encryption (assymetric)

ways to protect against unauthorized access and use 2
Ways to Protect Against Unauthorized Access and Use, 2

Secure Web pages: Use encryption to protect information transmitted via their Web pages

Secure Sockets Layer

Extended Validation SSL (EV SSL)

HTTPS – HTTP Secure, in browser address

Virtual private networks (VPNs): A private secure path over the Internet

secure web pages use digital certificates
Secure Web Pages UseDigital Certificates

Are data that can be used to verify the identity of a person or organization

Obtained from a Certificate Authority

Typically contains identity information about the person or organization, an expiration date, and a pair of keys to be used with encryption and digital signatures

digital signature
Digital Signature

Is a unique digital code that can be attached to an e-mail message or document

Guarantees

The identity of the sender

The content of the associated message or file

Uses public key encryption

Signed with the sender’s private key

Creates with key and document a unique digital signature

Verified using the sender’s public key

firewall protection
Firewall Protection

Can be hardware, software, or both

Is vital for home computers and businesses

Blocks access to the computer from the Internet

Blocks access to the Internet by programs on the user’s computer unless authorized by the user

Closes threatened communication ports

intrusion prevention system ips
Intrusion PreventionSystem (IPS)
  • Monitors a network or computer for threats
  • Identifies malicious activity
  • Reports threat
  • Tries to block or stop the threat
  • Records information about the threat
encryption
Encryption

Private key encryption: Uses a single key

Most often used to encrypt files on a computer

If used to send files to others, the recipient needs to be told the key

Public key encryption: Uses two keys

Publickey: Can be giventoanyone; usedtoencryptmessagesto be senttothatperson

Privatekey: Onlyknownbythe individual; usedtodecryptmessagesthat are encryptedwiththeindividual’spublickey

Key pairs can be obtainedthrough a CertificateAuthority

secure web pages
Secure Web Pages

Transmit credit card numbers and other sensitive data ONLY via a secure Web server

Look for a locked padlock on the status bar and https:// in the URL

Use Gmail, Hotmail, etc.? Consider a Web-based e-mail encryption service (ex., HushMail)

secure web pages 2
Secure Web Pages, 2

Use MS Outlook, AppleMail, etc.? Consider Email client encryption software (ex., PGP Desktop)

Various strengths of encryption available

Stronger is more difficult to crack

Strong = 128-bit

(16-character keys)

Military = 2,048-bit

(256-character keys)

virtual private network vpn
Virtual Private Network (VPN)

Allows authorized users to securely access a private network via the Internet

Much less expensive than a dedicated secure network since it uses the Internet

Can provide a secure environment over a large geographical area

Typically used by employees to access corporate networks remotely via the Internet

Personal VPNs can be used by individuals to surf safely at a wireless hotspot

when using public hotspots
When Using Public Hotspots …

Remember that a PH is an open network, with no encryption or other security

Turn off file sharing

Disable Wi-Fi and Bluetooth if not needed

Use firewall to block incoming connections

Turn off automatic and ad hoc connections

sensible business precautions
Sensible Business Precautions

Develop policies and controls

Screen job applicants carefully

Watch for disgruntled employees

and former employees

Use data-leakage prevention and

enterprise rights-management

software

Ask business partners to review their

security to avoid attacks coming from someone located at that organization

quick quiz
Quick Quiz

1. Which of the following is an example of possessed knowledge?

a. Password

b. Smart card

c. Fingerprint

2. True or False: With public key encryption, a single key is used to both encrypt and decrypt the file.

3. A(n) ______________________ controls access to a computer from the Internet and protects programs installed on a computer from accessing the Internet without authorization from the user.

Answers:

1) a; 2) False; 3) firewall

computer sabotage
Computer Sabotage

Computer sabotage: Acts of malicious destruction to a computer or computer resource

Botnet: A group of bots / zombies (computers controlled by a criminal (botherder)

Purpose: Send spam, plant and operate malware, launch Internet attacks, etc.

malware
Malware
  • Is any type of malicious software
  • Written to perform destructive acts (damaging programs, deleting files, erasing drives, etc.)
  • Writing malware is at least unethical
  • Distributing malware is definitely illegal
  • Infects (attacks) computers of all kinds, including mobile phones and mobile devices
types of malware
Types of Malware

Virus: A program installed without the user’s knowledge and designed to alter the way a computer operates or to cause harm to the computer system

Often attached to downloaded programs, media files, or e-mail messages

Worm: Malicious program designed to spread rapidly by sending copies of itself to other computers; does not have to attach itself to another file

Typically sent via e-mail

37

the stuxnet worm 2010
The Stuxnet Worm (2010)
  • Targets critical industrial control systems
  • May have Iranian nuclear facilities as primary victims
  • Spread by USB memory drive use
types of malware 2
Types of Malware, 2

Trojan horse: Malicious program that masquerades as something else

Usually appear to be a game or other program

Cannot replicate themselves; must be downloaded and installed

Rogue antivirus programs are common today

Mobile malware: Becoming more common

40

denial of service dos attack
Denial of Service (DoS) attack

Act of sabotage that attempts to flood a network server or Web server with so much activity that it is unable to function

Distributed DoS attack: Uses multiple computers

more computer sabotage
More Computer Sabotage

Data (or program) alteration: When a hacker breaches a computer system in order to delete or change data

Students changing grades

Employees performing vengeful acts, such as deleting or changing corporate data

Web site alteration: Changing content of a Web site

Web sites defaced to make political statements

Hacking into and changing social networking account contents (Facebook, Twitter, etc.)

Altering legitimate site to perform malware attacks

protecting against computer sabotage
Protecting AgainstComputer Sabotage

Security software program suite: Used to protect your computer against a variety of threats

Antivirus software: Used to detect and eliminate computer viruses and other types of malware

Should continuously check incoming e-mail messages, instant messages, Web page content, and downloaded files

Quarantines any suspicious content as it arrives

Should regularly scan computer

Set to download automatically new malware definitions (“signatures”)

44

protecting against computer sabotage1
Protecting Against Computer Sabotage

Some ISPs filter include virus checking

E-mail authentication systems can protect against viruses sent via e-mail

Common sense precautions can help prevent a virus infection

Web browser security settings can helpprotect against some attacks

quick quiz1
Quick Quiz

1. Which of the following is used to control your computer by someone else?

a. Worm

b. Trojan horse

c. Botnet

2. True or False: Computer viruses can only be spread via the Internet.

3. A(n) ______________________ is a type of malware that masquerades as something else

Answers:

1) c; 2) False; 3) Trojan horse

online theft online fraud and other dot cons
Online Theft, Online Fraud, and Other Dot Cons

Dot con: A fraud / scam carried out using the Internet

What is the target?

Personal SSNs

Other personal data

Proprietary corporate information

Money, credit card numbers, etc.

How is it done?

Breaking into online accounts

Stealing an actual computer or mobile device

Redirecting users to a fake web site

Keylogging, etc.

identity theft
Identity Theft

Using someone else’s identity to purchase goods or services, obtain new credit cards or bank loans, or illegally masquerade as that individual

Is very expensive and time consuming to repair

phishing
Phishing

Use of spoofed e-mail messages to gain credit card numbers and other personal data

Typically contains a link to a spoofed Web site

After victim clicks a link in the message and supplies sensitive data, that data is sent to the thief

E-mails and Web sites often look legitimate

slide52

Targets specific organizations or specific individuals

Includes more customized or personalized information to seem more legitimate

May impersonate someone in your organization, such as from human resources or the IT dept.

Ex., click-to-view

downloads a

keylogger

Spear Phishing

slide54

Is the use of spoofed domain names to obtain personal information

Hacks DNS servers to route requests for legitimate Web pages to spoofed Web pages (DNS poisoning)

Often uses company DNS servers

Drive-by pharming: Attacking home wireless routers that are still using default userids and passwords; changes router settings to use hacker’s DNS server

Pharming

slide55

An item purchased through an online auction is never delivered

The item is not as specified by the seller

Buyer sends counterfeit check or money order to seller for more than amount; asks seller to return the difference

Buyer told to use a (fake) money transfer company

Online Auction Fraud

slide56

Loan and pyramid scams

Work-at-home cons

West African letter fraud schemes

Nigerian scam!

Aka 419 scam

Soliciting of donations after disasters

Fake job site postings

Pornographic sites

Internet Offer Scams

caller id spoofing
Caller-ID Spoofing
  • Targets mobile phones
  • Causes recipient’s mobile display to show a Caller Id number from a trusted source, ex., a bank
  • Sends an automated call or text message
  • Tricks mobile user to reveal account information
protecting yourself
Protecting Yourself

Do not give out personal information (Social Security number, mother’s maiden name, etc.) unless absolutely necessary

Never give out sensitive information over the phone or by e-mail

Shred documents containing sensitive data, credit card offers, etc.

Don’t place sensitive outgoing mail in your mailbox

Read carefully your bills and credit reports

Get a free credit report from the three major consumer credit bureaus each year

http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre34.shtm

protecting yourself against phishing
Protecting Yourself Against Phishing

Never click a link in an e-mail to go to a secure Web site

Antiphishing tools built into Web browsers can help warn you of potential phishing sites

Some secure sites use methods to reassure users they are on the legitimate site

make tools services work for you
Make Tools, Services Work for YOU

Check online auction seller’s feedback before bidding

Pay for online purchases via a credit card so transactions can be disputed if needed

Use an online payment system, ex., PayPal

Take advantage of buyer protection

Use an escrow service for high-priced items

personal safety cyberbullying
Personal Safety: Cyberbullying

Is children or teenagers using the Internet to bully other children or teenagers

Victimizes perhaps 50% of all US teenagers

Makes victims angry, frustrated, sad, embarrassed and/or scared, although many simply ignore it

personal safety cyberstalking
Personal Safety: Cyberstalking

Repeated threats or harassing behavior between adults carried out via e-mail or another Internet communication method

Sendingharassing e-mail messagestothevictim

Postinginappropriatemessagesaboutthevictim

Signingthevictim up foroffensive material

Publicizingthevictim’scontactinformation

Hacking intovictim’s social networkingpages

Sometimes escalates to personal violence

personal safety online porn
Personal Safety: Online Porn

Concern for parents, schools, law enforcement

Difficult to stop in USA due to

Varied definitions of “pornography”

Personal constitutional rights issues

Online pornography involving minors is illegal

Internet can make it easier to arrange dangerous meetings between predators and children

safety tips for social networking sites
Safety TipsFor Social-Networking Sites

Be cautious online

Use gender-neutral, non-provocative UserID names

Do not reveal personal information

Request to have personal information removed from online directories

Do not respond to insults or harassing comments

safety tips for children
Safety Tips For Children

Parents must monitor Internet activities

Restrict, as “administrator,” child accounts

Have children use a computer in a family room

Make clear which activities are allowed

“Tell Mom or Dad” if they see a request for personal information or a personal meeting

network and internet security legislation 3
Network and Internet Security Legislation, 3

It is difficult for the legal system to keep pace with the rate at which technology changes

There are domestic and international jurisdictional issues

quick quiz2
Quick Quiz

1. Sending an e-mail that looks like it came from someone else in order to obtain information for fraudulent purposes is called ______________________.

a. hacking

b. online auction fraud

c. phishing

2. True or False: Cyberstalkers often find their victims online.

3. Using someone else’s identity to purchase goods or services or perform other transactions is called ______________________.

Answers:

1) c; 2) True; 3) identity theft

summary
Summary

Why Be Concerned about Network and Internet Security?

Unauthorized Access and Unauthorized Use

Protecting Against Unauthorized Access &Unauthorized Use

Computer Sabotage

Protecting Against Computer Sabotage

Online Theft, Online Fraud, and Other Dot Cons

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

Personal Safety Issues

Protecting Against Cyberbullying, Cyberstalking, and Other Personal Safety Concerns

Network and Internet Security Legislation