Network and Internet Security

Why Be Concerned About Network and Internet Security?

2

• Computer Crime (cybercrime)
• Any illegal act involving a computer, including:
• Theft of financial assets
• Manipulating data for personal advantage
• Act of sabotage (releasing a computer virus, shutting

down a Web server)

• Phishing and Internet scams
• All computer users should be aware of security concerns and

the precautions that can be taken

Unauthorized Access and Unauthorized Use

3

• Unauthorized Access
• Gaining access to a computer, network, file, or other

resource without permission

• Unauthorized Use
• Using a computer resource for unapproved activities
• Both can be committed by insiders and outsiders
• Codes of Conduct
• Used to specify rules for behavior, typically by a

business or school

Unauthorized Access and Unauthorized Use

4

• Hacking
• Using a computer to break into another computer

system

• A serious threat for individuals, businesses, and the country (national security), i.e., cyberterrorism
• Often performed via wireless networks today

– Many wireless networks are left unsecured

• War Driving
• Driving around an area to find a Wi-Fi network to

access and use without authorization

Unauthorized Access and Unauthorized Use

5

• Wi-Fi Piggybacking
• Accessing an unsecured Wi-Fi network from the

hacker’s current location without authorization

• Interception of Communications
• Unsecured messages, files, logon information, etc., can be

intercepted using software designed for that purpose

• New trend: intercept credit and debit card information during the card verification process
• Packetsniffing software

Protecting Against Unauthorized Access and Unauthorized Use

6

• Access Control Systems
• Used to control access to facilities, computer networks,

company databases, and Web site accounts

• Identification Systems
• Verify that the person trying to access the facility or

system is an authorized user

• Authentication Systems
• Determine if the person is who he or she claims to be

Protecting Against Unauthorized Access and Unauthorized Use

10

• Possessed Knowledge Access Systems
• Use information that only the authorized user should know
• Typically passwords
• Passwords should be strong and changed frequently
• Typically used in conjunction with usernames
• Disadvantages
• Passwords can be forgotten
• If known, password can be used by someone who is not an authorized user

Protecting Against Unauthorized Access and Unauthorized Use

8

Protecting Against Unauthorized Access and Unauthorized Use

9

• Cognitive Authentication Systems
• Use information the individual knows or can easily

remember (birthplace, pet names, etc.)

• Used in many password recovery systems
• Two-Factor Authentication
• Using two different methods to authenticate users
• Typically possessed knowledge (password) with either
• Biometric Feature – something you are
• Possessed Object – something you have
• Hard token – physical object used
• Soft token – supplies a one-time password (OTP)

Protecting Against Unauthorized Access and Unauthorized Use

10

Protecting Against Unauthorized Access and Unauthorized Use

11

• Possessed Object Access Systems
• Use a physical object an individual has in his/her

possession to identify that individual

• Smart cards, magnetic cards
• RFID-encoded badges, USB security keys or tokens

Protecting Against Unauthorized Access and Unauthorized Use

12

• Disadvantages
• Can be lost or used by an unauthorized

individual

• Biometric Access Systems
• Identifies users by a particular unique biological

characteristic

• Fingerprint, hand, face, iris, voice, etc.
• Data read by biometric reader must match what is stored

in a database

Protecting Against Unauthorized Access and Unauthorized Use

13

• Often used to:
• Control access to secure facilities
• Log on to computers, punch in/out at work, law

enforcement, etc.

• Advantages
• Biometric access systems are very accurate
• Cannot be lost or forgotten
• Disadvantages
• Cannot be reset if compromised
• Hardware and software are expensive

Protecting Against Unauthorized Access and Unauthorized Use

14

Protecting Against Unauthorized Access and Unauthorized Use

15

• Controlling Access to Wireless Networks
• In general, Wi-Fi is less secure than wired networks
• Security is usually off by default; wireless networks should

be secured

• Wireless network owners should:
• Change the router’s default password
• Enable encryption (WPA2 is more secure than WPA)
• Enable other security features as needed

– Can hide network name (SSID)

Protecting Against Unauthorized Access and Unauthorized Use

16

How It Works Box

Securing a Wireless Home Router

• Use router’s configuration

screen

• Be sure to change the

access password

• Enter the SSID name, select the security mode, and type a secure passphrase
• Can use MAC filtering

20

Protecting Against Unauthorized Access and Unauthorized Use

18

• Firewalls
• A collection of hardware and/or software intended to protect a computer or computer network from unauthorized access
• Typically two-way, so they check all incoming (from the

Internet) and outgoing (to the Internet) traffic

• Important for home computers that have a direct Internet connection, as well as for businesses
• Work by closing down external communications ports

Protecting Against Unauthorized Access and Unauthorized Use

19

Protecting Against Unauthorized Access and Unauthorized Use

20

• Intrusion Prevention System (IPS) Software
• Monitors traffic to try and detect possible attacks
• If an attack is discovered, IPS software can immediately

block it

• Encryption
• Method of scrambling contents of e-mail or files to make

them unreadable if intercepted

• Secure Web pages use encryption
• SSL and EV SSL

Protecting Against Unauthorized Access and Unauthorized Use

21

• Private Key Encryption (symmetric key encryption)
• Uses a single key
• Most often used to encrypt files on a computer
• If used to send files to others, the recipient and sender must agree on the private key to be used
• Public Key Encryption (asymmetric key encryption)
• Uses two keys (a private key and a public key) to encrypt and decrypt documents
• Public key can be given to anyone
• Key pairs are obtained through a Certificate Authority

Protecting Against Unauthorized Access and Unauthorized Use

22

Protecting Against Unauthorized Access and Unauthorized Use

23

• Web-based encrypted e-mail (HushMail) is available
• Various strengths of encryption available
• Stronger is more difficult to crack
• Strong = 128-bit (16-character keys)
• Military = 2,048-bit (256-character keys)

Protecting Against Unauthorized Access and Unauthorized Use

24

• Virtual Private Networks (VPNs)
• A private secure path over the Internet
• Allows authorized users to securely access a private

network via the Internet

• Much less expensive than a private secure network
• Can provide a secure environment over a large

geographical area

• Typically used by businesses to remotely access corporate

networks via the Internet

• Personal VPNs can be used by individuals to surf safely at a wireless hotspot

Protecting Against Unauthorized Access and Unauthorized Use

25

• Additional Public Hotspot Precautions

– Individuals should take additional precautions when using public hotspots in addition to using security software, secure Web pages, VPNs, and file encryption

Protecting Against Unauthorized Access and Unauthorized Use

26

• Sensible Employee Precautions
• Screen potential new hires carefully
• Watch for disgruntled employees and ex-employees
• Ask business partners to review their security
• Develop policies and controls
• Use software to manage devices and prevent data leaks
• Data leakage prevention systems
• Outbound-content monitoring systems
• Mobile device management (MDM) - BYOD

Protecting Against Unauthorized Access and Unauthorized Use

30

Inside the Industry Box

28

Securing BYOD

• BYOD = Bring Your Own Device
• Some businesses use BYOD as a cost-saving measure
• Individuals want to carry their devices with them and use for both work and personal use
• Security is a disadvantage
• Businesses need to ensure company networks and data are not adversely affected
• MDM software can help
• Containerization can separate work and personal data and apps

Computer Sabotage

29

• Computer Sabotage
• Acts of malicious destruction to a computer or computer

resource

• Launching a computer virus
• Denial of Service (DoS) attack
• Botnet
• A group of bots (computers controlled by a hacker) that are controlled by one individual and work together in a coordinated fashion
• Used by botherders (criminals) to send spam, launch Internet attacks, and spread malware

Computer Sabotage

30

• Malware
• Any type of malicious software
• Written to perform destructive acts (damaging programs,

deleting files, erasing drives, etc.)

• Logic bomb
• Time bomb
• Writing malware is considered unethical; distributing is illegal

Computer Sabotage

31

• Computer Viruses
• A software program installed without the user’s knowledge and designed to alter the way a computer operates or to cause harm to the computer system
• Often embedded in downloaded programs and e-mail

messages (games, videos, music files)

• Computer Worm
• Malicious program designed to spread rapidly by sending

copies of itself to other computers via a network

• Typically sent as an e-mail attachment

Computer Sabotage

32

Computer Sabotage

33

• Trojan Horse
• Malicious program that masquerades

as something else

• Usually appears to be a game or utility program
• Cannot replicate themselves; must be

downloaded and installed

• Rogue antivirus programs (scareware) are common today
• Ransomware

Computer Sabotage

34

• Mobile Malware
• Can infect smartphones, media tablets, printers, etc.
• Smartphones with Bluetooth are particularly vulnerable to

attack

• Mobile threats are expected to continue to increase
• Denial of Service (DoS) Attacks
• Act of sabotage that attempts to flood a network server or Web server with so much activity that it is unable to function
• Distributed DoS Attacks target popular Web sites and use multiple computers

Computer Sabotage

35

Computer Sabotage

40

• Data, Program, or Web Site Alteration
• Sabotage occurs when a hacker breaches a computer

system in order to delete/change data or modify programs

• Student changing grades
• Employee performing vengeful acts, such as

deleting or changing corporate data

• Data on Web sites can also be altered
• Hacking into and changing social networking account

contents (Facebook pages, Twitter tweets, etc.)

• Altering legitimate site to perform malware attacks

Protecting Against Computer Sabotage

37

• Security Software
• Typically a suite of programs used to protect your

computer against a variety of threats

• Antivirus Software
• Used to detect and eliminate computer viruses and

other types of malware

• Should be set up to run continuously to check incoming e-mail messages, instant messages, Web page content, and downloaded files
• Quarantines any suspicious content as it arrives
• Should be set to perform regular system scans

Protecting Against Computer Sabotage

38

• Keep your security software up to date as new malware is introduced all the time
• ISPs and Web mail providers today also offer some

malware protection to their subscribers

• Other Security Precautions
• Control access to computers and networks
• Intrusion protection systems can help businesses detect and protect against denial of service (DoS) attacks

Protecting Against Computer Sabotage

39

Trend Box

40

Beyond Fingerprint Readers—Digital Tattoos and More

• Facial gestures can be used to unlock a phone by smiling or

winking at it

• Some include Liveness Check
• Future alternatives for logging individuals on to devices or

secure Web sites

• Digital tattoos are stamped onto skin
• Authentication pills

are swallowed

Online Theft, Online Fraud, and Other Dot Cons

41

• Dot Con
• A fraud or scam carried out through the Internet
• The Internet Crime Complaint Center received and processed more than 24,000 complaints per month in 2012
• Data or Information Theft
• Theft of data or information located on or being sent from a computer
• Can occur in several ways
• Stealing an actual computer or mobile device
• A hacker gaining unauthorized access

Online Theft, Online Fraud, and Other Dot Cons

42

• Identify Theft
• Using someone else’s identity to purchase goods or services, obtain new credit cards or bank loans, or illegally masquerade as that individual
• Information obtained via documents, stolen information,

spyware, etc.

• Expensive and time consuming to recover from
• Millions of Americans have their identity stolen each year

Online Theft, Online Fraud, and Other Dot Cons

43

Online Theft, Online Fraud, and Other Dot Cons

44

• Phishing
• Use of spoofed e-mail messages to gain credit card

numbers and other personal data

• Spear Phishing
• A personalized phishing scheme targeted to specific

individuals

• Social Media Hacks
• The act of accessing someone else’s social media account to make changes to the content or to perform an activity as that individual

Online Theft, Online Fraud, and Other Dot Cons

50

Online Theft, Online Fraud, and Other Dot Cons

46

• Pharming
• The use of spoofed domain names to obtain personal

information

• DNS servers are hacked to route requests for legitimate Web pages to spoofed Web pages (DNS poisoning)
• Drive-by Pharming
• Hacker changes the victims designated DNS server to the pharmer’s DNS server

Online Theft, Online Fraud, and Other Dot Cons

47

• Online Auction Fraud
• Occurs when an item purchased through an online auction

is never delivered or the item is not as specified

• Illegal, but as with other types of online fraud, prosecution is difficult
• Other Internet Scams
• Loan and pyramid scams
• Work-at-home cons
• Nigerian letter fraud scheme
• Pornographic sites
• Fake job site postings

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

48

• Protecting Against Data and Information Theft
• Businesses should use good security measures
• Individuals should not give out personal information (Social Security number, mother’s maiden name, etc.) unless absolutely necessary
• Protecting Against Identity Theft, Phishing, and Pharming
• Shred documents containing sensitive data, credit card offers, etc.
• Order a full credit history on yourself a few times a year to

check for accounts listed in your name

• Don’t place sensitive outgoing mail in your mailbox

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

• Watch bills and credit report to detect identity theft early
• Never click a link in an e-mail message to go to a secure

Web site—always type the URL in the browser instead

• Antiphishing Tools
• Antiphishing tools built into Web browsers can help

warn you of potential phishing sites

• Some secure sites use additional layers of security to protect against identity thieves
• Some banks and other financial institutions add an

additional step in their logon process

49

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

50

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

51

Technology and You Box

52

Online Financial Alerts

• Can get e-mail or text alerts

for account activity

• Can help identify unauthorized activity quickly
• Online money management aggregator services can be used to view the status of multiple accounts (credit cards, bank accounts, etc.)
• Can set up alerts

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

53

• Digital Certificate
• Group of electronic data that can be used to verify the

identity of a person or organization

• Obtained from Certificate Authorities
• Typically contains identity information about the person or organization, an expiration date, and a pair of keys to be used with encryption and digital signatures
• Are also used with secure Web sites to guarantee that the site is secure and actually belongs to the stated individual or organization
• Can be SSL or EV SSL

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

54

• Digital signatures
• Unique digital codes that can be attached to an e-mail

message or document

• Can be used to verify the identity of the sender
• Can be used to guarantee the message or file has not been changed since it was signed
• Uses public key encryption
• Document is signed with the sender’s private key
• The key and the document create a unique digital signature
• Signature is verified using the sender’s public key

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

60

Protecting Against Online Theft, Online Fraud, and Other Dot Cons

56

• Protecting Against Online Auction Fraud and Other Internet Scams
• Use common sense
• Check online auction seller’s feedback before bidding
• Pay for online purchases via a credit card so transactions

can be disputed if needed

• Use an online payment system
• Take advantage of buyer protection
• Use an escrow service for high-priced items

Personal Safety Issues

57

• Cyberbullying
• Children or teenagers bullying other children or teenagers

via the Internet

• E-mails
• Social networking sites
• Blogs
• Common today--estimated to affect 50% of all US teenagers

Personal Safety Issues

58

• Cyberstalking
• Repeated threats or harassing behavior between adults carried out via e-mail or another Internet communication method
• Although there are no specific federal laws against

cyberstalking, all states have made it illegal

• Online Pornography
• Attempts to ban this type of material from the Internet

have not been successful

• Online pornography involving minors is illegal

Protecting Against Cyberbullying, Cyberstalking, and Other Personal Safety Concerns

59

• Safety Tips for Adults
• Be cautious and discreet online
• Use gender-neutral, nonprovocative identifying names
• Do not reveal personal information
• Can request your personal information be removed from

online dire

• Safety Tips for Children and Teens
• Monitor children’s computer and smart phone activities
• Caution older children about sending compromising photos; sexting can result in child pornography charges being filed against teens

Network and Internet Security Legislation

60

Thank You