Internet Fundamentals/Security

Phish

Malware

This lesson introduces Internet security, including browser and browsing security, personally identifiable information, and related ethical and legal issues.

Objectives and Skills

Objectives and skills for this lesson include:

• Identify security issues related to Internet clients (e.g., Web browsers, e-mail, instant messaging) in the workplace, including certificates, malware, illicit servers, viruses.
• Identify and use principles of Personal Information Management (PIM), including common applications.
• Identify security-related ethical and legal issues faced by IT professionals.

Readings

1. Wikipedia: Internet security
2. Wikipedia: Personally identifiable information
3. Wikibooks: Ethics for IT Professionals/Professional Code of Ethics

Multimedia

1. YouTube: The Internet: Encryption & Public Keys
2. YouTube: Symmetric Key and Public Key Encryption
3. YouTube: The Internet: Cybersecurity & Crime
4. YouTube: Cybersecurity 101

Student Presentations

1. YouTube: Browser Security
2. YouTube: Security in Microsoft Edge

Activities

1. Complete the following tutorials:
   • GCFLearnFree: Internet Safety
   • TutorialsPoint: Internet Security
2. Practice web browser safety.
   • Review browser options:
     • Chrome: Google: Choose Your Privacy Settings.
     • Firefox: Mozilla: Privacy and Security Settings.
     • Internet Explorer: Microsoft: Change Security and Privacy Settings for Internet Explorer.
     • Opera: Opera: Guide to security and privacy
     • Safari: Apple: Manage Cookies and Other Website Data.
   • Check your browser's version to ensure the browser is up to date.
   • Check add-ons to ensure they are up to date.
   • Disable unneeded add-ons.
   • Clear the browser cache. Identify how to clear browser history and cookies.
   • Check autoform settings and remove any personal information you do not want saved.
   • Visit a secure website, such as https://en.wikiversity.org and view certificate information for that website.
   • Use private / incognito browsing to visit a website that normally remembers you. Notice how you are unknown to the website when using private browsing.
3. Use anti-malware software to scan your system and test malware detection.
   • All: Review Wikipedia: Comparison of antivirus software. Download a free, well-known anti-malware application and scan your system.
   • All: Review Wikipedia: EICAR test file. Download and save the EICAR test file to test your anti-malware application and follow the process for removing malware.
4. Research password managers and multi-factor authentication. Consider setting up a password manager and using multi-factor authentication on your Apple, Facebook, Google, and/or Microsoft accounts, as well as your password manager and your financial institutions.
5. Test your firewall using a testing service such as Gibson Research: ShieldsUP!

Lesson Summary

• Internet security is a branch of computer security specifically related to the Internet, often involving browser security but also network security on a more general level, as it applies to other applications or operating systems as a whole. Its objective is to establish rules and measures to use against attacks over the Internet.
• The Internet represents an insecure channel for exchanging information leading to a high risk of intrusion or fraud, such as phishing, online viruses, trojans, worms, and more.
• A computer user can be tricked or forced into downloading software onto a computer that is of malicious intent. Such software comes in many forms, such as viruses, Trojan horses, spyware, and worms.
• Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. Malware is defined by its malicious intent, acting against the requirements of the computer user, and does not include software that causes unintentional harm due to some deficiency. The term badware is sometimes used, and applied to both true (malicious) malware and unintentionally harmful software.
• A botnet is a network of zombie computers that have been taken over by a robot or bot that performs large-scale malicious acts for the creator of the botnet.
• Computer Viruses are programs that can replicate their structures or effects by infecting other files or structures on a computer. The common use of a virus is to take over a computer to steal data.
• Computer worms are programs that can replicate themselves throughout a computer network, performing malicious tasks throughout.
• Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in order for the restriction to be removed.
• Scareware is scam software with malicious payloads, usually of limited or no benefit, that are sold to consumers via certain unethical marketing practices. The selling approach uses social engineering to cause shock, anxiety, or the perception of a threat, generally directed at an unsuspecting user.
• Spyware refers to programs that surreptitiously monitor activity on a computer system and report that information to others without the user's consent.
• A Trojan horse, commonly known as a Trojan, is a general term for malicious software that pretends to be harmless, so that a user willingly allows it to be downloaded onto the computer.
• KeyLogger, Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard.
• A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users.
• Phishing occurs when the attacker pretends to be a trustworthy entity, either via email or web page.
• TCP/IP protocols may be secured with cryptographic methods and security protocols. These protocols include Secure Sockets Layer (SSL), succeeded by Transport Layer Security (TLS) for web traffic, Pretty Good Privacy (PGP) for email, and IPsec for the network layer security.
• Multi-factor authentication (MFA) is a method of computer access control in which a user is granted access only after successfully presenting several separate pieces of evidence to an authentication mechanism – typically at least two of the following categories: knowledge (something they know), possession (something they have), and inherence (something they are).
• A computer firewall controls access between networks and generally consists of gateways and filters which vary from one firewall to another. Firewalls also screen network traffic and are able to block traffic that is dangerous.
• Antivirus software and Internet security programs can protect a programmable device from attack by detecting and eliminating viruses.
• A password manager is a software application that helps a user store and organize passwords.
• Personally identifiable information (PII), or sensitive personal information (SPI), is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.
• Ethical codes are adopted by organizations to assist members in understanding the difference between 'right' and 'wrong' and in applying that understanding to their decisions.
• An ethical code generally implies documents at three levels: codes of business ethics, codes of conduct for employees, and codes of professional practice.

Key Terms

antivirus software

Computer software used to prevent, detect, and remove malicious software.

asymmetric encryption

A cryptographic system that uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner.

authentication

The act of confirming identity.

decryption

The process of converting unintelligible ciphertext back to plaintext.

digital certificate

An electronic document used to prove the ownership of a public key.

digital signature

A mathematical scheme for demonstrating the authenticity of digital messages or documents.

encryption

The process of converting plaintext into unintelligible ciphertext.

hash function

Any function that allows one to easily verify that some input data maps to a given hash value, but if the input data is unknown, it is deliberately difficult to reconstruct it by knowing the stored hash value.

IPsec

A network protocol suite that authenticates and encrypts the packets of data sent over a network.

malware (malicious software)

Hostile or intrusive software, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs.

patch

Software designed to update a computer program.

personally identifiable information (PII)

Information that can be used to identify an individual in context.

phishing

The attempt to obtain sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.

ransomware

Malware that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid.

right to be forgotten

The right of an individual to have certain information deleted so that others can no longer trace them.

spyware

Software that aims to gather information about a person or organization without their knowledge.

SSL/TLS

Cryptographic protocols that provide communications security over a computer network.

symmetric encryption

Algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext.

Trojan

Any malicious computer program which misleads users of its true intent.

virus

Malware that, when executed, replicates itself by modifying other computer programs and inserting its own code.

worm

Standalone malware that replicates itself in order to spread to other computers.

Assessments

• Flashcards: Quizlet: CIW IBA Lesson 8
• Flashcards: Quizlet: CIW IBA Lesson 8 Vocabulary
• Quiz: Quizlet: CIW IBA Lesson 8
• Quiz: Quizlet: CIW IBA Lesson 8 Vocabulary

See Also

• IT Fundamentals/Security
• Wikibooks: Introduction to Computer Information Systems/Security
• StaySafeOnline: Online Safety Basics
• US-CERT: Avoiding Social Engineering and Phishing Attacks
• CISA: Cyber Games

References

← Networking

Internet Fundamentals

HTML →