08IT035 vvp IT

INTERNET SECURITY

Prepared By
JEMINI GANATRA

I
08IT035 VVP IT

A Seminar report on

INTERNET SECURITY

Submitted

To

V.V.P. Engineering College

Gujarat Technological University

For partial fulfillment

Of the requirement for the award of the degree of

B.E. (Information & Technology)

Prepared By Guided By

Jemini Ganatra Ms. Vidhi

2010

ii
08IT035 VVP IT

V.V.P. ENGINEERING COLLEGE

CERTIFICATE

This is to certify that the work presented in the seminar entitled

INTERNET SECURITY
has been carried out by

JEMINI GANATRA
08IT035
In a manner sufficiently satisfactory to warrant its acceptance as a partial fulfillment of
the requirement for the award of the degree of

B.E. in Information & Technology Engineering

This is a bonafide work done by his/her and has not been submitted to any other
University / Institute for the award of any other Degree/ Diploma

Under the guidance of

Seminar Guide Head of the Department

Ms. Vidhi Makadiya Prof. Avani Vasant

iii
08IT035 VVP IT

ACKNOWLEDGEMENT

The satisfaction that accompanies that the successful completion of any task
would be incomplete without the mention of people whose ceaseless cooperation made
it possible, whose constant guidance and encouragement crown all efforts with
success. We are grateful to our project guide Ms.Viddhi for the guidance, inspiration
and constructive suggestions that helped us in the preparation of this project.

iv
08IT035 VVP IT

ABSTRACT

The Internet is a pervasive force which is working its way into all aspects of our
civilization - of this fact there is no doubt. One could spend countless hours, days, and months
debating and studying the implications and connotations of this fact and its influence on
education, business, etc. However, in studying this medium, it is important to remain cautious
and realize the security issues surrounding the Internet. Being overly cautious and
conservative in this exploration is detrimental and foolish - the resources left undiscovered by
frightened people will be expanded by others, leaving the paranoid in the dust. However, it is
ultimately more careless to assume that all is legitimate and nothing will harm you. It's that
old principle of "that'll never happen to me" that can make one vulnerable. Educated medium
should be achieved between these extremes. We plan to take a look at the current work of
hackers threatening e-commerce, politics, and individuals with a range of viruses. Also what
is the difference between personal computers, e-commerce, and computer networks on college
campuses when it comes to security? Most importantly, how secure do you feel? How do age
and gender affect people's reactions on this matter? What general precautions can be affected
to make the common computer user better educated and more confident with their security?
We propose to research security policies and their effectiveness with an emphasis on current
events and the boom of buying and trading online. Then taking this information and
correlating with data compiled from extensive surveying of college students and the public
with a focus on age as a determining factor in the matter of personal security on the Internet.

v
08IT035 VVP IT

TABLE OF CONTENT

vi
08IT035 VVP IT

INTRODUCTION

Internet security is a branch of computer security specifically related to the Internet. It's
objective is to establish rules and measure to use against attacks over the Internet. The
Internet represents an insecure channel for exchanging information leading to a high risk of
intrusion or fraud (e.g. phishing). Different methods have been used to protect the transfer of
data, including encryption.

When the term network security is used, it refers to the security of the network in general.
This includes such issues as password security, network sniffing, intrusion detection,
firewalls, network structure and so forth.

1.1 Security Violation Definition

Computer or network security has been violated when unauthorized access by any party
occurs.

Why Security?

Computer security is required because most organizations can be damaged by hostile software
or intruders. There may be several forms of damage which are obviously interrelated. These
include:

 Damage or destruction of computer systems.

 Damage or destruction of internal data.
 Loss of sensitive information to hostile parties.
 Use of sensitive information against the organization's customers which may result in
legal action by customers against the organization and loss of customers.
 Damage to the reputation of an organization.

The methods used to accomplish these unscrupulous objectives are many and varied
depending on the circumstances. This guide will help administrators understand some of these
methods and explain some countermeasures.

vii
08IT035 VVP IT

Security Issues

Computer security can be very complex and may be very confusing to many people. It can
even be a controversial subject. Network administrators like to believe that their network is
secure and those who break into networks may like to believe that they can break into any
network. I believe that overconfidence plays an important role in allowing networks to be
intruded upon. There are many fallacies that network administrators may fall victim to. These
fallacies may allow administrators to wrongfully believe that their network is more secure
than it really is.

This guide will attempt to clarify many issues related to security by doing the following:

 Help you determine what you are protecting.

 Break computer security into categories.
 Explain security terms and methods.
 Point out some common fallacies that may allow administrators to be overconfident.
 Categorize many common attacks against networks and computers.
 Explain some attack methods.
 Describe tools that can be used to help make a network more secure.

Security Limitations and Applications

If you are reading this document and are thinking that you can get all the information required
to make your network completely secure, then you are sadly mistaken. In many ways,
computer security is almost a statistical game. You can reduce but not eliminate the chance
that you may be penetrated by an intruder or virus. This is mainly for one reason.

No one can ever know all the software vulnerabilities of all software used on a system.

This is why even those who consider themselves hackers will say that the number one
computer security threat is the lack of quality in the applications and operating systems. At
this point, I could talk about the various corporate entities that write software and why

viii
08IT035 VVP IT

software lacks the quality that many of us believe that it should possess, but that subject is not
only way beyond the scope of this document, but also way beyond the scope of this project.

The bottom line here is that unless you can remove all the application and operating system
problems that allow viruses and intruders to penetrate networks, you can never secure your
network. Additionally the users on your network are potentially a greater security risk than
any programs. Obviously removing all vulnerabilities is impossible and will not secure your
network against user errors. I have even considered the possibility that an operating system
without a network interface can be completely secure, but even this cannot be guaranteed.
Unknown viruses or trojan programs can creep in with applications on CDs or floppies. This
has been known to happen. Although an attacker may not be able to get data from the system,
they can damage or destroy data.

Layered Security

The fact that complete security is impossible is the reason security experts recommend
"layered security". The idea is to have multiple ways of preventing an intrusion to decrease
the chance that intrusions will be successful. For example, you should have virus protection
on your client computers. To help layer this security you should also filter viruses at your
email server. To help even more, you should block the most dangerous types of email
attachments to prevent unrecognized viruses and other hostile software from entering your
network. Another good defense layer would also include educating your users about viruses,
how they spread, and how to avoid them.

Hackers

There are many documents that attempt to define the term hacker. I believe that the term
hacker is a connotative term. This means that it is more defined by people's beliefs rather than
by a dictionary. Some believe that a hacker is a very skilled computer person. Others believe
that hackers are those that perform unauthorized break ins to computer systems. The media
and many sources have caused many uninformed people to believe that a hacker is a threat to
computer and network security while this is not the case. A hacker is no more likely to break

ix
08IT035 VVP IT

the law than anyone else. I use the more accurate descriptive term, "intruder" to describe those
who intrude into networks or systems without authorization.

Physical Security

This guide will not talk about physical computer security beyond this paragraph. Your
organization should be aware how physically secure every aspect of its network is because if
an intruder gets physical access, they can get your data. Be sure the your organization
properly secures locations and consider the following:

 Servers - Contain your data and information about how to access that data.
 Workstations - Man contain some sensitive data and can be used to attack other
computers.
 Routers, switches, bridges, hubs and any other network equipment may be used as an
access point to your network.
 Network wiring and media and where they pass through may be used to access your
network or place a wireless access point to your network.
 External media which may be used between organizational sites or to other sites the
organization does business with.
 Locations of staff who may have information that a hostile party can use.

Some employees may take data home or may take laptops home or use laptops on the internet
from home then bring them to work. Any information on these laptops should be considered
to be at risk and these laptops should be secure according to proper policy when connected
externally on the network.

x
08IT035 VVP IT

SECUERITY REQUIREMENTS
If you are an individual who is only concerned about the security needs of your home
computer and do not want to learn alot about computer security, then there are some simple
guidelines that you should read;

Most home computers require the following:

 A personal firewall when connecting to the internet over any type of connection.
 Anti-virus software that is kept updated.
 Back up your data onto another computer, CD-ROM, ZIP drive, or tape regularly.
 Regular security updates to the operating system (these are not as critical if a personal
firewall is installed, but this item is still important).
 Regular updates to the applications run on the system such as Microsoft Office.

Be aware of the following:

You should also be aware that most data that you send or receive on the internet can be
read by other people. Therefore you should be aware of the sensitivity of the data or
information you are sending. If you need to send confidential data you should only send
it to sites that begin with https:// or use some software to encrypt your data.

 Be careful when opening email attachments since they may contain hostile
programs even if your antivirus software has not detected it.
 Be careful when downloading and installing programs on the internet. You
should scan any programs for viruses that you get on the internet, but also be
aware that some programs may be spyware or other malware used to gain access
to your system.

If you are someone who is responsible for your orgainzation's security and/or you are
learning about computer security, then you should read this complete document.

xi
08IT035 VVP IT

SECURITY ATTACKS

This page lists types of security attacks. This document will address security issues, measures,
and policies which take these types of attacks into consideration.

 DoS- Denial of Service

 Trojan Horse - Comes with other software.
 Virus - Reproduces itself by attaching to other executable files.

xii
08IT035 VVP IT

 Worm - Self-reproducing program. Creates copies of itself. Worms that spread using
e-mail address books are often called viruses.
 Logic Bomb - Dormant until an event triggers it (Date, user action, random trigger,
etc.).

Hacker Attacks

I use the term "hacker attacks" to indicate hacker attacks that are not automated by programs
such as viruses, worms, or trojan horse programs. There are various forms that exploit
weakneses in security. Many of these may cause loss of service or system crashes.

 IP spoofing - An attacker may fake their IP address so the receiver thinks it is sent
from a location that it is not actually from. There are various forms and results to this
attack.
o The attack may be directed to a specific computer addressed as though it is
from that same computer. This may make the computer think that it is talking
to itself. This may cause some operating systems such as Windows to crash or
lock up.
 Gaining access through source routing. Hackers may be able to break through other
friendly but less secure networks and get access to your network using this method.
 Man in the middle attack -
o Session hijacking - An attacker may watch a session open on a network. Once
authentication is complete, they may attack the client computer to disable it,
and use IP spoofing to claim to be the client who was just authenticated and
steal the session. This attack can be prevented if the two legitimate systems
share a secret which is checked periodically during the session.
 Server spoofing - A C2MYAZZ utility can be run on Windows 95 stations to request
LANMAN (in the clear) authentication from the client. The attacker will run this
utility while acting like the server while the user attempts to login. If the client is
tricked into sending LANMAN authentication, the attacker can read their username
and password from the network packets sent.
 DNS poisoning - This is an attack where DNS information is falsified. This attack can
succeed under the right conditions, but may not be real practical as an attack form. The

xiii
08IT035 VVP IT

attacker will send incorrect DNS information which can cause traffic to be diverted.
The DNS information can be falsified since name servers do not verify the source of a
DNS reply. When a DNS request is sent, an attacker can send a false DNS reply with
additional bogus information which the requesting DNS server may cache. This attack
can be used to divert users from a correct webserver such as a bank and capture
information from customers when they attempt to logon.

Hostile Software

Hostile software programs may have several different types of functions. These functions
may cause damage or allow unauthorized access to be gained allowing the program to be
spread or information may be compromised. These are some functions that hostile software
may perform:

 Damaging operating systems.

 Damaging or destroying data.
 Sniffing the network for any data or passwords.
 Installing itself or some other hostile software on computer systems for later use.
 Acquisition of unencrypted passwords on the network.
 Forwarding compromised information to hostile parties through the firewall.
 Harvesting e-mail addresses.
 Putting unsolicited advertisements on infected computer systems. These programs are
called adware and may come with other "useful" applications.
 Spyware - A type of program that usually comes with a useful application but sends
information to its creator about what the computer user is doing on the internet. Some
of these programs creators actually tell the user that the program comes with ability to
see what the user is doing on the internet. Others do not.

You should be aware that all types of hostile programs such as viruses and trojans can
perform any of the above functions. There is a tendency for viruses to only damage systems
or data, and trojan programs to send compromised data to other parties, but either type of
program can perform any of the functions. This is why all unauthorized programs are a very
serious matter.

Viruses

Viruses reproduce themselves by attaching themselves to other files that the used does not

xiv
08IT035 VVP IT

realize are infected. Viruses are spread today mainly through E-mail attachments. The
attachment may be a file that is a legitimate file but the virus may be attached as a macro
program in the file. An example is a Microsoft word file. These files can contain macro
programs which can be run by Microsoft Word. A virus may infect these files as a macro and
when they get on the next user's computer, they can infect other files. These virus programs
normally take advantage of a security vulnerability of the running application. In the case of
this example a Microsoft Word macro permission security vulnerability is exploited. Viruses
can directly affect executable files or Dynamic Link Library (DLL ) files that the operating
systems and applications use to run.

Usually the virus will spread before it will do anything that may alert the user to its presence.

The countermeasure to prevent virus programs from infiltrating your organization is to

implement the countermeasures in the section titled "Software vulnerability Control".
Running virus scanning software on every computer in the organization is a primary step in
minimizing this step.

Trojan Horse Software

The name "Trojan horse" comes from the historical incident where the Greeks built a horse
statue as a tool to take the city of Troy. They hid soldiers inside. The people of Troy thought
that they were victorious and the gods had given them the horse as a gift, they pulled the horse
inside the city. At night the soldiers inside the horse snuck out and opened the gates of the city
letting the main Greek army into the city.

Trojan horse software is software that appears to have some useful function, but some hidden
purpose awaits inside. This purpose may be to send sensitive information from inside your
organization to the author of the software.

The countermeasure to prevent trojan horse programs from infiltrating your organization is to
implement the countermeasures in the section titled "Software vulnerability Control".
Allowing only approved software with proper testing to be run in the organization will

xv
08IT035 VVP IT

minimize the threat of these programs. The organizational security policy can help ensure that
all members of the organization operate in compliance with this countermeasure.

 Password cracking - Used to get the password of a user or administrator on a network

and gain unauthorized access

Buffer-overflow attacks

Buffer overflows are a favorite exploit for hackers. The vast majority of Microsoft's available
patches fix unchecked buffer problems -- but what about applications developed in-house?
They are just as susceptible as commercial applications to buffer-overflow attack. It is
therefore critical that you understand how they work and perform vulnerability testing on your
home-grown applications prior to deployment.

A buffer overflow is an exploit that takes advantage of a program that is waiting on a user's
input. There are two main types of buffer overflow attacks: stack based and heap based. Heap-
based attacks flood the memory space reserved for a program, but the difficulty involved with
performing such an attack makes them rare. Stack-based buffer overflows are by far the most
common.

xvi
08IT035 VVP IT

TYPES OF INTERNET SECURITY

3.1 Network Layer Security

The network layout has much influence over the security of the network. The placement of
servers with respect to the firewall and various other computers can affect both network
performance and security. There may even be areas of the network that are more secure than
others. Some of these areas may be further protected with an additional firewall. A typical
network is shown below.

xvii
08IT035 VVP IT

In this network, the box labeled "IDS" is an intrusion detection system which may be a
computer or deviced designed to log network activity and detect any suspicious activity. In
this diagram it is shown outside the firewall, on the semi-private network and protecting the
servers on the private network. It may be a good idea to place an IDS just inside the firewall
to protect the entire private network since an attack may be first launched against a
workstation before being launched against a server. The IDS protecting the servers could be
moved to protect the entire private network, but depending on cost and requirements it is also
good to protect your servers, especially the mail server.

The semi-private network is commonly called a "DMZ" (for DeMilitarized Zone) in many
security circles. In this diagram the semi-private network contains a mail relay box to increase
security since the mail server is not directly accessed. The mail relay box routes mail between
the internet and the mail server.

Other network equipment used includes:

xviii
08IT035 VVP IT

 Routers - Used to route traffic between physical networks. Many routers provide
packet filtering using access control lists (ACLs). This can enhance network security
when configured properly. Routers can be configured to drop packets for some
services and also drop packets depending on the source and/or destination address.
Therefore routers can help raise the security between different segments on a network
and also help isolate the spread of viruses.
 Switches - A switch is used to regulate traffic at the data link layer of the OSI network
model. This is the layer which uses the Media Access Control (MAC) address. It is
used to connect several systems to the network and regulates network traffic to reduce
traffic on the network media. This can reduce collisions.
 Media - The physical cable that carries the signal for the network traffic.

Routers can be set up to perform packet filtering to enhance network security.

1.2 Network/User Functions

The consideration of how each computer system on the network is used is a very important
part of computer and network security. These considerations can even be used to enhance cost
savings where neccessary.

Many times when security vulnerabilities are published, an older version of software may not
be supported by the manufacturer. This may require an operating system upgrade or an
additional license to be purchased to upgrade specific software. This may be very cost
prohibitive to many organizations. When dealing with these situations, it is important to
consider your network layout and how it is used.

One consideration that should be kept in mind when dealing with network security is what
users can perform what functions and what computers these users can use. For example the
following situation may exist in an organization:

 Some users can receive and send both internal and external e-mail while others can
only send and receive internal e-mail.
 User's who can only send and receive internal e-mail will not have users on their
systems who can use external e-mail.

Considering this situation, the computers that can only receive internal e-mail are less of a
security risk than those who can receive external e-mail. Many viruses spread with e-mail. If
computers that send and receive external email do not get the virus, then it is not likely to

xix
08IT035 VVP IT

spread to those computers that only deal with internal e-mail. Therefore it is more important
to fix application vulnerabilities on computers that deal with external e-mail than on those that
do not. In this way, a virtual perimeter of protection may be established in an organization.
This may not be the most secure network configuration, but it is much more secure than not
updating any computers at all.

1.3 Network security

In the field of networking, the specialist area of network security. consists of the provisions
and policies adopted by the network administrator to prevent and monitor unauthorized
access, misuse, modification, or denial of the computer network and network-accessible
resources.

Network security concepts

Network security starts from authenticating the user, commonly with a username and a
password. Since this requires just one thing besides the user name, i.e. the password which is
something you 'know', this is sometimes termed one factor authentication. With two factor
authentication something you 'have' is also used (e.g. a security token or 'dongle', an ATM
card, or your mobile phone), or with three factor authentication something you 'are' is also
used (e.g. a fingerprint or retinal scan).

Once authenticated, a firewall enforces access policies such as what services are allowed to be
accessed by the network users. Though effective to prevent unauthorized access, this
component may fail to check potentially harmful content such as computer worms or Trojans
being transmitted over the network. Anti-virus software or an intrusion prevention system
(IPS), help detect and inhibit the action of such malware. An anomaly-based intrusion
detection system may also monitor the network and traffic for unexpected (i.e. suspicious)
content or behavior and other anomalies to protect resources, e.g. from denial of service
attacks or an employee accessing files at strange times. Individual events occurring on the
network may be logged for audit purposes and for later high level analysis.

Communication between two hosts using a network could be encrypted to maintain privacy.

xx
08IT035 VVP IT

Honeypots, essentially decoy network-accessible resources, could be deployed in a network as

surveillance and early-warning tools as the honeypot will not normally be accessed.
Techniques used by the attackers that attempt to compromise these decoy resources are
studied during and after an attack to keep an eye on new exploitation techniques. Such
analysis could be used to further tighten security of the actual network being protected by the
honeypot.

Security management

Security Management for networks is different for all kinds of situations. A small home or an
office would only require basic security while large businesses will require high maintenance
and advanced software and hardware to prevent malicious attacks from hacking and
spamming.

Small homes

 A basic firewall like COMODO Internet Security or a unified threat management

system.
 For Windows users, basic Antivirus software like AVG Antivirus, ESET NOD32
Antivirus, Kaspersky, McAfee, Avast!, Zone Alarm Security Suite or Norton
AntiVirus. An anti-spyware program such as Windows Defender or Spybot – Search
& Destroy would also be a good idea. There are many other types of antivirus or anti-
spyware programs out there to be considered.
 When using a wireless connection, use a robust password. Also try to use the strongest
security supported by your wireless devices, such as WPA2 with AES encryption.
 If using Wireless: Change the default SSID network name, also disable SSID
Broadcast; as this function is unnecessary for home use. (However, many security
experts consider this to be relatively useless. http://blogs.zdnet.com/Ou/index.php?
p=43 )
 Enable MAC Address filtering to keep track of all home network MAC devices
connecting to your router.
 Assign STATIC IP addresses to network devices.
 Disable ICMP ping on router.
 Review router or firewall logs to help identify abnormal network connections or traffic
to the Internet.
 Use passwords for all accounts.
 Have multiple accounts per family member, using non-administrative accounts for
day-to-day activities. Disable the guest account (Control Panel> Administrative
Tools> Computer Management> Users).

xxi
08IT035 VVP IT

 Raise awareness about information security to children.

Medium businesses

 A fairly strong firewall or Unified Threat Management System

 Strong Antivirus software and Internet Security Software.
 For authentication, use strong passwords and change it on a bi-weekly/monthly basis.
 When using a wireless connection, use a robust password.
 Raise awareness about physical security to employees.
 Use an optional network analyzer or network monitor.
 An enlightened administrator or manager.

Large businesses

 A strong firewall and proxy to keep unwanted people out.

 A strong Antivirus software package and Internet Security Software package.
 For authentication, use strong passwords and change it on a weekly/bi-weekly basis.
 When using a wireless connection, use a robust password.
 Exercise physical security precautions to employees.
 Prepare a network analyzer or network monitor and use it when needed.
 Implement physical security management like closed circuit television for entry areas
and restricted zones.
 Security fencing to mark the company's perimeter.
 Fire extinguishers for fire-sensitive areas like server rooms and security rooms.
 Security guards can help to maximize security.

School

 An adjustable firewall and proxy to allow authorized users access from the outside and
inside.
 Strong Antivirus software and Internet Security Software packages.
 Wireless connections that lead to firewalls.
 Children's Internet Protection Act compliance.
 Supervision of network to guarantee updates and changes based on popular site usage.
 Constant supervision by teachers, librarians, and administrators to guarantee
protection against attacks by both internet and sneakernet sources.
 security via firewall

Large government

 A strong firewall and proxy to keep unwanted people out.

 Strong Antivirus software and Internet Security Software suites.

xxii
08IT035 VVP IT

 Strong encryption.
 White list authorized wireless connection, block all else.
 All network hardware is in secure zones.
 All host should be on a private network that is invisible from the outside.
 Put web servers in a DMZ, or a firewall from the outside and from the inside.
 Security fencing to mark perimeter and set wireless range to this.

3.2 Electronic mail security (E-mail)

 Background Understanding of how email messages are composed, delivered, and

stored is helpful in understanding email security.This is a multiple step process. The
process starts with message composition. When the user finishes composing the
message and sends the message, the message is then transformed into a specific
standard format specified by Request for Comments (RFC) 2822, Internet Message
Format. Once the message is translated into an RFC 2822 formatted message, it can be
transmitted. Using a network connection, the mail client, referred to as a mail user
agent (MUA), connects to a mail transfer agent (MTA) operating on the mail server.
After initiating communication, the mail client provides the sender’s identity to the
server. Next, using the mail server commands, the client tells the server who are the
intended recipients. After the complete recipient list is sent to the server the client
supplies the message. Once the mail server is processing the message, several events
occur: recipient server identification, connection establishment, and message
transmission. Using Domain Name System (DNS) services, the sender’s mail server
determines the mail server(s) for the recipient(s). Then, the server opens up a
connection(s) to the recipient mail server(s) and sends the message employing a
process similar to that used by the originating client. Finally the message is delivered
to the recipient.

 Pretty Good Privacy (PGP) PGP provides confidentiality by encrypting messages

to be transmitted or data files to be stored locally using an encryption algorithm such
3DES, CAST-128. Email messages can be protected by using cryptography in various
ways, such as the following:

 Sign an email message to ensure its integrity and confirm the identity of its
sender.
 Encrypt the body of an email message to ensure its confidentiality.
 Encrypt the communications between mail servers to protect the confidentiality
of both the message body and message header.(Cryptography)

The first two methods, message signing and message body encryption, are often used
together. The third cryptography method, encrypting the transmissions between mail servers,
is typically applicable only when two organizations want to protect emails regularly sent

xxiii
08IT035 VVP IT

between them. For example, the organizations could establish a virtual private network .(VPN)
to encrypt the communications between their mail servers over the Internet. Unlike methods
that can only encrypt a message body, a VPN can encrypt entire messages, including email
header information such as senders, recipients, and subjects. In some cases, organizations may
need to protect header information. However, a VPN solution alone cannot provide a message
signing mechanism, nor can it provide protection for email messages along the entire route
from sender to recipient.

 Multipurpose Internet Mail Extensions (MIME) MIME transforms non-ASCII

data at the sender's site to Network Virtual Terminal (NVT) ASCII data and delivers it
to client's Simple Mail Transfer Protocol (SMTP) to be sent through the internet. The
server SMTP at the receiver's side receives the NVT ASCII data and delivers it to
MIME to be transformed back to the original non-ASCII data.
 Secure/Multipurpose Internet Mail Extensions (S/MIME) S/MIME provides a
consistent means to securely send and receive MIME data. S/MIME is not only
limited to email but can be used with any transport mechanism that carries MIME
data, such Hypertext Transfer Protocol (HTTP).

 Anti-Spam Control Most modern mail servers use several anti-spam controls, one of
which is the Real-time Blackhole List or RBL. The Real-time Blackhole List prevents
mail coming from known spamming domains from reaching your users. It does this by
comparing the IP address of the sender with a list of known spammers. If the IP
address is found, the mail is rejected.

Firewall Protection

xxiv
08IT035 VVP IT

It limits and regulates the access from the outside to the internal network and also regulates
traffic going out. It is used to keep outsiders from gaining information to secrets or from
doing damage to internal computer systems. Firewalls are also used to limit the access of
individuals on the internal network to services on the internet along with keeping track of
what is done through the firewall.

Firewalls filter traffic based on their protocol, sending or receiving port, sending or receiving
IP address, or the value of some status bits in the packet. There are several types of firewalls
which include packet filtering, circuit level relay, and application proxy.

If your organization does not have a firewall, get one. At least implement a packet filtering
firewall on a Linux based computer, if money is the concern.

 The firewall should filter e-mail, FTP file transfers, and web content traffic for
potential harmful or hostile code and viruses.
 No computer should be directly connected to the internet without going through an IS
approved firewall. This means independent modem connections to the internet should
be forbidden.

Firewall Policy

xxv
08IT035 VVP IT

 Set up a "spoofing filter" on your firewall - Don't allow traffic from the internet that
indicates a source IP address matching any of your internal network addresses. This
keeps attackers from "spoofing" your machines and possibly causing them to crash.

Prevent spoofing from your network - Place an outbound filter (for addresses inside your
network attempting outside access) on the firewall that only allows traffic from valid internal
network addresses to be serviced. This should prevent attacks against other networks from
being originated in your network.

Types of Firewalls

 Packet Filters

Packet filters are one of several different types of firewalls that process network traffic on
packet-by-packet basis. Its main job is to filter traffic from a remote IP host, so a router is
needed to connect the internal network to the internet. The routers is known as screening
router, which screens packets leaving and entering the network.

 Circuit-Level Gateways

The Circuit-Level Gateway represents proxy server that statically defines what traffic will be
allowed. Circuit proxies always forward packets containing a given port number, if the port
number is permitted by the rules set. This gateway operates at the network level of OSI
model. IT act as IP address translator between internet and internal network. The main
advantage of proxy server is its ability to provide Network Address Translation (NAT). NAT
hides the IP address from the internet. This process effectively protects all internal
information from internet.

 Application-Level Gateways

The application-level gateways represents the proxy server operating at the TCP/IP
application level. A packet is forwarded only if a connection is established using some known
protocol. The application gateway analysis the whole message instead of individual packets
when receiving or sending data.

Password Security

Passwords are a primary piece of information that intruders will try to acquire in order to gain
unauthorized access to systems or networks.

Password Storage

xxvi
08IT035 VVP IT

When users enter passwords for the network or operating system, they or some facsimile of
them must be stored so there is something to compare user login attempts to. There are three
primary choices for password storage:

 Clear text
 Encrypted password
 Hash value of a password - Used by Unix and Windows NT

The storage locations may be:

 Root or administrator readable only

 Readable by anyone.

Passwords are more secure when they can only be read by the administrator or root account.
Also the best password storage security is to store the hashed value of a password.

Typical Hashing Functions

 UNIX - Algorithm similar to DES with 56 bit key. There are two random characters
(salt) are added to the algorithm so two password values are not stored the same even
if they are the same.
 Windows NT - MD4 is used to generate a 128 bit value.

Password Protection and Cracking

Passwords should be chosen wisely and a dictionary word should never be used. This is
because if an attacker can get the hashed or encrypted value of a password, they can run
password guessing programs to eventually guess the password by comparing the encryped
result of the guess to the actual encrypted password. The easiest password attack is a
dictionary attack where dictionary words are used to guess the password. Other attacks
include a brute force attack which can take much longer than a dictionary attack. This is why
passwords should have a minimum length and a minimum degree of complexity. The
complexity requirements should include three of four of the following four types of
characters:

 Lowercase

xxvii
08IT035 VVP IT

 Uppercase
 Numbers
 Special characters such as !@#$%^&*(){}[]

For help in choosing passwords wisely see the article Tips for choosing Passwords that can
be easily remembered, but are secure

Protocols to send passwords

 PAP - Password Authentication Protocol - Used with Point to Point Protocol (PPP).
The password is sent in the clear.

CHAP - Challenge handshake authentication protocol is preferred rather than PAP since the
actual password is not sent across the internet or network.

Anti-virus

Some apparently useful programs also contain features with hidden malicious intent. Such
programs are known as Malware, Viruses, Trojans, Worms, Spyware and Bots.

 Malware is the most general name for any malicious software designed for example
to infiltrate, spy on or damage a computer or other programmable device or system of
sufficient complexity, such as a home or office computer system, network, mobile
phone, PDA, automated device or robot.
 Viruses are programs which are able to replicate their structure or effect by integrating
themselves or references to themselves, etc. into existing files or structures on a
penetrated computer. They usually also have a malicious or humorous payload
designed to threaten or modify the actions or data of the host device or system without
consent. For example by deleting, corrupting or otherwise hiding information from its
owner.
 Trojans (Trojan Horses) are programs which may pretend to do one thing, but in
reality steal information, alter it or cause other problems on a such as a computer or
programmable device / system.
 Spyware includes programs that surreptitiously monitor keystrokes, or other activity
on a computer system and report that information to others without consent.
 Worms are programs which are able to replicate themselves over a (possibly
extensive) computer network, and also perform malicious acts that may ultimately
affect a whole society / economy.

xxviii
08IT035 VVP IT

 Bots are programs that take over and use the resources of a computer system over a
network without consent, and communicate those results to others who may control
the Bots.

The above concepts overlap and they can obviously be combined. The terminology, along
with the dangers involved, are constantly evolving.

Antivirus programs and Internet security programs are useful in protecting a computer or
programmable device / system from malware.

Such programs are used to detect and usually eliminate viruses. Anti-virus software can be
purchased or downloaded via the Internet. Care should be taken in selecting anti-virus
software, as some programs are not as effective as others in finding and eliminating viruses or
malware. Also, when downloading anti-virus software from the Internet, one should be
cautious as some websites say they are providing protection from viruses with their software,
but are really trying to install malware on your computer by disguising it as something else.

Anti-spyware

There are two major kinds of threats in relation to spyware:

Spyware collects and relays data from the compromised computer to a third-party.

Adware automatically plays, displays, or downloads advertisements. Some types of adware

are also spyware and can be classified as privacy-invasive software. Adware often are
integrated with other software.

Browser choice

As of December 2008, 68.2% of the browser market was held by Internet Explorer. As a
result, malware creators often exploit Internet Explorer. Internet Explorer market share is
continuously dropping (as of 2009; see list of web browsers for statistics) as users switch to

xxix
08IT035 VVP IT

other browsers, most notably Firefox (with 21.3% market share), Safari (web browser) (with
7.9% market share) and Google Chrome (1% market share).

USER SECURITY ISSUES

User Education

 Use caution opening e-mails. Do not open mail from unknown originators.

xxx
08IT035 VVP IT

 Make users aware of ability for hackers to hide executable files as text or other
harmless file types.
 Users must be educated not to use the same passwords at work that they may use over
unsecured connections on the internet.

Password Policies

 Logon passwords must be changed at least every 90 days (30-60 days recommended).
 Minimum password age policy - 5 days.
 Passwords must be at least 8 characters long and use at least two numbers.
 On Windows Domain networks in the "Domain Security Policy" tool, select "Security
Settings", "Account Policies", and "Password Policy". Enable the "passwords must
meet complexity requirements" rule. This means at least one character from three of
the following categories must be included:
o lowercase
o uppercase
o numbers
o special characters such as !@#$%^&*(){}[]
 Passwords must be kept secret and not written down.
 Don't let programs save passwords.
 Lock account after 3 failed logon attempts within 15 minutes.
 Account lockout should be reset by an administrator.
 No clear text passwords that can allow access to any sensitive information should be
sent through any unsecured network such as the internet.
 The use of clear text passwords that can allow access to any sensitive information on a
secure network should be avoided. This means that the use of FTP programs (unless
over VPN) should be avoided. Secure Shell (SSH) programs can be used to perform
the same function with encrypted passwords.
 Passwords should not be stored using reversible encryption.

Account Policy

 Remote users should be disconnected on NT domains after 1-4 hours of inactivity.

This keeps users logged off after business hours so attackers can't use an open account
to launch an attack from. Also any open files are closed and the tape backup program
can backup all files. Open files are not backed up.
 Set the account policy "Users must log on in order to change password".

Server Policies on Windows Domains

 Don't rename the Administrator Account, but don't allow it to access the domain
controller computer(s) from the network. Create a new account with the same or

xxxi
08IT035 VVP IT

similar privileges as the administrator and give this account an ability to access the
domain controllers over the network. When someone tries to log onto the
administrator account over the network, it can be flagged as an attempted security
violation.

xxxii
08IT035 VVP IT

SECURTY SERVICES

 enhance security of data processing systems and information transfers of an

organization

 intended to counter security attacks

 using one or more security mechanisms

 often replicates functions normally associated with physical documents

which, for example, have signatures, dates; need protection from disclosure, tampering, or
destruction; be notarized or witnessed; be recorded or licensed

X.800:

“a service provided by a protocol layer of communicating open systems, which ensures

adequate security of the systems or of data transfers”

RFC 2828:

“a processing or communication service provided by a system to give a specific kind of

protection to system resources”

xxxiii
08IT035 VVP IT

MODEL FOR INTERNET SECURITY

 using this model requires us to:

o design a suitable algorithm for the security transformation

o generate the secret information (keys) used by the algorithm
o develop methods to distribute and share the secret information
o specify a protocol enabling the principals to use the transformation and
secret information for a security service

xxxiv
08IT035 VVP IT

MODEL FOR NETWORK ACCESS SECURITY

 using this model requires us to:

o select appropriate gatekeeper functions to identify users

o implement security controls to ensure only authorised users access designated

information or resources

 trusted computer systems may be useful to help implement this model

CONCLUSIONS

xxxv
08IT035 VVP IT

Computer security is a vast topic that is becoming more important because the world is
becoming highly interconnected, with networks being used to carry out critical transactions.
The environment in which machines must survive has changed radically since the
popularization of the Internet. Deciding to connect a local area network (LAN) to the Internet
is a security-critical decision. The root of most security problems is software that fails in
unexpected ways. Although software security as a field has much maturing to do, it has much
to offer to those practitioners interested in striking at the heart of security problems. The goal
of this book is to familiarize you with the current best practices for keeping security flaws out
of your software.

Good software security practices can help ensure that software behaves properly. Safety-
critical and high-assurance system designers have always taken great pains to analyze and to
track software behavior. Security-critical system designers must follow suit. We can avoid the
Band-Aid-like penetrate-and-patch approach to security only by considering security as a
crucial system property. This requires integrating software security into your entire software
engineering process.

REFERENCES

 http://www.wikipedia.com/internetsecurity
xxxvi
08IT035 VVP IT

 http://howstuffworks.com/internetsecurity

 http://internetsecurity.sys-con.com

 http://answers.com

 http://www.ibm.com/developerworks/websphere/techjournal/0904_amrhe
in/0904_amrhein.html 

 http://Amazon.com

 http://itcd.hq.nasa.gov/networking-vpn.html

xxxvii