Lesson08 Security
Lesson08 Security
Lesson 8
FOCUS LESSON
1|Page
Introduction
The Internet has transformed our lives in many good ways. Unfortunately, this vast network and
its associated technologies also have brought in their wake, the increasing number of security
threats. The most effective way to protect yourself from these threats and attacks is to be aware
of standard cybersecurity practices.
Computer Security deals with the protection of computer systems and information from
harm, theft, and unauthorized use. The main reason users get attacked frequently is that they
lack adequate defenses to keep out intruders, and cybercriminals are quick to exploit such
weaknesses. Computer security ensures the confidentiality, integrity, and availability of your
computers and their stored data.
Computer security basically is the protection of computer systems and information from
harm, theft, and unauthorized use. It is the process of preventing and detecting unauthorized
use of your computer system.
There are various types of computer security which is widely used to protect the valuable
information of an organization.
Data confidentiality: Assures that private or confidential information is not made available or
disclosed to unauthorized individuals.
Privacy: Assures that individuals control or influence what information related to them may be
collected and stored and by whom and to whom that information may be disclosed.
Data integrity: Assures that information (both stored and in transmitted packets) and programs
are changed only in a specified and authorized manner.
System integrity: Assures that a system performs its intended function in an unimpaired
manner, free from deliberate or inadvertent unauthorized manipulation of the system.
3.Availability: Ensuring timely and reliable access to and use of information. A loss of
availability is the disruption of access to or use of information or an information system. Assures
that systems work promptly and service is not denied to authorized users.
2|Page
Types of computer security
1. Cyber Security: Cyber security means securing our computers, electronic devices, networks ,
programs, systems from cyber attacks. Cyber attacks are those attacks that happen when our
system is connected to the Internet.
2. Information Security: Information security means protecting our system’s information from
theft, illegal use and piracy from unauthorized use. Information security has mainly three
objectives: confidentiality, integrity, and availability of information.
3. Application Security: Application security means securing our applications and data so that
they don’t get hacked and also the databases of the applications remain safe and private to the
owner itself so that user’s data remains confidential.
4. Network Security: Network security means securing a network and protecting the user’s
information about who is connected through that network. Over the network hackers steal, the
packets of data through sniffing and spoofing attacks, man in the middle attack, war driving, etc,
and misuse the data for their benefits.
1. Denial of service attack or DOS: A denial of service attack is a kind of cyber attack in which
the attackers disrupt the services of the particular network by sending infinite requests and
temporary or permanently making the network or machine resources unavailable to the
intended audience.
2. Backdoor: In a backdoor attack, malware, trojan horse or virus gets installed in our system
and start affecting it’s security along with the main file. Consider an example: suppose you are
installing free software from a certain website on the Internet. Now, unknowingly, along with this
software, a malicious file also gets installed, and as soon as you execute the installed software
that file’s malware gets affected and starts affecting your computer security. This is known as a
backdoor.
4. Phishing: Phishing is pronounced as “fishing” and working functioning is also similar. While
fishing, we catch fish by luring them with bait. Similarly, in phishing, a user is tricked by the
attacker who gains the trust of the user or acts as if he is a genuine person and then steals the
information by ditching. Not only attackers but some certain websites that seem to be genuine,
but actually they are fraud sites. These sites trick the users and they end up giving their
personal information such as login details or bank details or card number etc. Phishing is of
many types: Voice phishing, text phishing etc.
3|Page
that one is otherwise unauthorized to obtain. Spoofing is of several types- email spoofing, IP
address spoofing, MAC spoofing , biometric spoofing etc.
8. Polymorphic Attacks: Poly means “many” and morph means “form”, polymorphic attacks are
those in which attacker adopts multiple forms and changes them so that they are not
recognized easily. These kinds of attacks are difficult to detect due to their changing forms.
In order to protect our system from the above-mentioned attacks, users should take certain
steps to ensure system security:
1. Always keep your Operating System up to date. Keeping it up to date reduces the risk of
their getting attacked by malware, viruses, etc.
2. Always use a secure network connection. One should always connect to a secure network.
Public wi-fi’s and unsecured networks should be avoided as they are at risk of being attacked
by the attacker.
3. Always install an Antivirus and keep it up to date. An antivirus is software that scans your PC
against viruses and isolates the infected file from other system files so that they don’t get
affected. Also, we should try to go for paid anti-viruses as they are more secure.
5. Use strong passwords. Always make strong passwords and different passwords for all social
media accounts so that they cannot be key logged, brute forced or detected easily using
dictionary attacks. A strong password is one that has 16 characters which are a combination of
upper case and lower case alphabets, numbers and special characters. Also, keep changing
your passwords regularly.
6. Don’t trust someone easily. You never know someone’s intention, so don’t trust someone
easily and end up giving your personal information to them. You don’t know how they are going
to use your information.
7. Keep your personal information hidden. Don’t post all your personal information on social
media. You never know who is spying on you. As in the real world, we try to avoid talking to
strangers and sharing anything with them. Similarly, social media also have people whom you
don’t know and if you share all your information on it you may end up troubling yourself.
4|Page
8. Don’t download attachments that come along with e-mails unless and until you know that e-
mail is from a genuine source. Mostly, these attachments contain malware which, upon
execution infect or harms your system.
9. Don’t purchase things online from anywhere. Make sure whenever you are shopping online
you are doing so from a well-known website. There are multiple fraud websites that may steal
your card information as soon as you checkout and you may get bankrupt by them.
10. Learn about computer security and ethics. You should be well aware of the safe computing
and ethics of the computing world. Gaining appropriate knowledge is always helpful in reducing
cyber-crime.
11. If you are attacked, immediately inform the cyber cell so that they may take appropriate
action and also protect others from getting attacked by the same person. Don’t hesitate to
complain just because you think people may make your fun.
12. Don’t use pirated content. Often, people try to download pirated movies, videos or web
series in order to get them for free. These pirated content are at major risk of being infected
with viruses, worms, or malware, and when you download them you end up compromising your
system security.
Network attacks are malicious attempts to gain unauthorized entry into an organization’s
network. Two main categories of network attacks are passive and active. Passive attacks
involve monitoring or stealing sensitive information without altering data, while active attacks
involve accessing and modifying data, potentially causing harm. In network attacks, the focus is
on breaching the corporate network perimeter and gaining access to internal systems.
Attackers may also incorporate other attack methods once inside the network, such as
compromising endpoints, spreading malware, or exploiting vulnerabilities.
Network security involves safeguarding computer networks and the data they transmit
from unauthorized access, use, disclosure, disruption, modification, or destruction. It
encompasses a range of practices and technologies designed to protect valuable data and
resources from malicious actors. Network security measures protect against external threats
such as hackers and malware, as well as internal vulnerabilities that can compromise data
integrity and confidentiality.
5|Page
Types of Network Attacks
Malware
Malware attacks pose a serious threat as hackers are able to gain unauthorized entry into
target systems and unleash malicious codes that disrupt or corrupt files and data. These
attacks have the potential to impact both internal and external endpoint devices within a
network, emphasizing the importance of robust cybersecurity measures to safeguard against
such threats.
Viruses
These malicious software programs can spread rapidly from one computer to another, and their
destructive capabilities include corrupting files, infecting connected devices, and stealing
sensitive personal information, making them a serious concern for individuals and organizations
alike. These viruses often spread through deceptive methods, such as malicious email links or
infected website downloads, highlighting the importance of being vigilant and exercising caution
when accessing online content.
Worms
Computer worms are a form of harmful software that propagate by copying themselves from
one infected computer to another. These worms take advantage of weaknesses in network
security to achieve their goals, and can infect systems without assistance from external users.
Phishing
Phishing attacks use social engineering to deceive users into clicking on a counterfeit email link
or message that appears authentic. By clicking on the link, malware is installed onto their
devices, allowing hackers to access and pilfer sensitive information like credit card details or
banking passwords.
Botnets
Denial-of-Service (DoS) attacks involve malicious actors employing a single host network to
launch an attack, while Distributed Denial-of-Service (DDoS) attacks are more complex, using
multiple compromised computers to exploit systems. DDoS attacks can result in sudden traffic
spikes during product launches, promotions, or sales, which can overwhelm servers. DDoS
attacks are particularly challenging to detect due to the involvement of numerous compromised
hosts, making it difficult to trace the origin of the attack.
6|Page
Man-in-the-Middle
Man-in-the-Middle (MIM) attacks occur when malicious actors intercept and disrupt private
communications between two unsuspecting parties. These cybercriminals, known as “black
hats,” effectively position themselves as the middleman, allowing them to monitor and control
the information exchanged between the victims. By doing so, they can disrupt files, intercept
sensitive data, and engage in espionage.
Ransomware
5G Based Attacks
The advent of 5G networks, while enabling ultra-fast data transmission, has also amplified the
number of network attacks. Exploiting the high bandwidth and low latency offered by 5G,
malicious actors have devised swarm-based network attacks that target mobile devices,
internet of things (IoT) networks, and even critical systems. These attacks allow attackers to
infiltrate and manipulate systems in real-time, potentially causing severe damage or data theft.
The sophistication of 5G-based attacks has made them a formidable challenge for
cybersecurity professionals.
SQL Injection attacks pose a significant threat to businesses, enabling hackers to exploit
vulnerabilities in poorly designed applications and websites with unsecured user-input fields.
These attacks can lead to data theft by compromising any website using an SQL-based
database. Upskilling teams through credible network defense programs is paramount in
mitigating cybercriminal activities, ensuring the protection of businesses against network
attacks and the safeguarding of sensitive data.
Below are the most notable ways to protect your company from network attacks:
Network Segmentation
To enhance network security, it is crucial to segregate the network using methods such as
subnetting or VLANs. This involves dividing the network into distinct zones based on security
requirements. By isolating different areas of the network, the potential damage caused by a
security breach can be limited to a single zone, preventing its spread to other critical areas.
Additionally, this approach forces attackers to take extra steps and overcome multiple obstacles
to access other zones, adding a layer of protection to sensitive data and systems.
7|Page
Proxy Server for Internet Access Control
To regulate and monitor access to the internet, a proxy server can be deployed. This
transparent proxy allows administrators to control and inspect all user traffic, preventing
unchecked internet access. It also helps verify the legitimacy of users, mitigating the risk posed
by bots and automated mechanisms. By whitelisting only approved websites for corporate use,
organizations can restrict access to potentially malicious or inappropriate content, reducing the
likelihood of security breaches and data loss.
The widespread use of computers has led to some important user health concerns. The
following sections discuss health risks and preventions, along with measures users can take to
keep the environment healthy.
1. A repetitive strain injury (RSI) is an injury or disorder of the muscles, nerves, tendons,
ligaments, and joints. Computer-related RSIs include tendonitis and carpal tunnel
syndrome. RSIs are the largest job-related injury and illness problem in the United
States today. Tendonitis is inflammation of a tendon due to some repeated motion or
stress on that tendon. Carpal tunnel syndrome (CTS) is inflammation of the nerve that
connects the forearm to the palm of the wrist. Repeated or forceful bending of the wrist
can cause CTS or tendonitis of the wrist. Symptoms of tendonitis of the wrist include
extreme pain that extends from the forearm to the hand, along with tingling in the
fingers. Symptoms of CTS include burning pain when the nerve is compressed, along
with numbness and tingling in the thumb and first two fingers. Long-term computer work
can lead to tendonitis or CTS. Factors that cause these disorders include prolonged
typing, prolonged mouse usage, or continual shifting between the mouse and the
keyboard. If untreated, these disorders can lead to permanent physical damage. You
can take many precautions to prevent these types of injuries. Take frequent breaks
during the computer session to exercise your hands and arms. To prevent injury due to
8|Page
typing, place a wrist rest between the keyboard and the edge of your desk. To prevent
injury while using a mouse, place the mouse at least six inches from the edge of the
desk. In this position, your wrist is flat on the desk. Finally, minimize the number of times
you switch between the mouse and the keyboard, and avoid using the heel of your hand
as a pivot point while typing or using the mouse.
9|Page
3. Ergonomics and Workplace Design
Ergonomics is an applied science devoted to incorporating comfort, efficiency, and
safety into the design of items in the workplace. Ergonomic studies have shown that
using the correct type and configuration of chair, keyboard, display device, and work
surface helps users work comfortably and efficiently and helps protect their health. For
the computer work space, experts recommend an area of at least two feet by four feet.
10 | P a g e
Figures 1-3 – A well-designed work area should be flexible to allow adjustments to the height
and build of different individuals. God lighting and air quality also are important considerations.
4. Computer Addiction
Some computer users become obsessed with the computer and the Internet. Computer
addiction occurs when the computer consumes someone’s entire social life. Computer
addiction is a growing health problem but can be treated through therapy and support groups.
Ethics is based on well-founded standards of right and wrong that prescribe what
humans ought to do, usually in terms of rights, obligations, benefits to society, fairness, or
specific virtues. Some years ago, sociologist Raymond Baumhart asked business people,
"What does ethics mean to you?" Among their replies were the following:
These replies might be typical of our own. The meaning of "ethics" is hard to pin down, and the
views many people have about ethics are shaky. Like Baumhart's first respondent, many
people tend to equate ethics with their feelings. But being ethical is clearly not a matter of
following one's feelings. A person following his or her feelings may recoil from doing what is
right. In fact, feelings frequently deviate from what is ethical.
Nor should one identify ethics with religion. Most religions, of course, advocate high ethical
standards. Yet if ethics were confined to religion, then ethics would apply only to religious
people. But ethics applies as much to the behavior of the atheist as to that of the devout
religious person. Religion can set high ethical standards and can provide intense motivations
for ethical behavior. Ethics, however, cannot be confined to religion nor is it the same as
religion.
Being ethical is also not the same as following the law. The law often incorporates ethical
standards to which most citizens subscribe. But laws, like feelings, can deviate from what is
ethical. Our own pre-Civil War slavery laws and the old apartheid laws of present-day South
Africa are grotesquely obvious examples of laws that deviate from what is ethical.
11 | P a g e
Finally, being ethical is not the same as doing "whatever society accepts." In any society, most
people accept standards that are, in fact, ethical. But standards of behavior in society can
deviate from what is ethical. An entire society can become ethically corrupt. Nazi Germany is a
good example of a morally corrupt society.
Moreover, if being ethical were doing "whatever society accepts," then to find out what is
ethical, one would have to find out what society accepts. To decide what I should think about
abortion, for example, I would have to take a survey of American society and then conform my
beliefs to whatever society accepts. But no one ever tries to decide an ethical issue by doing a
survey. Further, the lack of social consensus on many issues makes it impossible to equate
ethics with whatever society accepts. Some people accept abortion but many others do not. If
being ethical were doing whatever society accepts, one would have to find an agreement on
issues which does not, in fact, exist.
What, then, is ethics? Ethics is two things. First, ethics refers to well-founded standards of right
and wrong that prescribe what humans ought to do, usually in terms of rights, obligations,
benefits to society, fairness, or specific virtues. Ethics, for example, refers to those standards
that impose the reasonable obligations to refrain from rape, stealing, murder, assault, slander,
and fraud. Ethical standards also include those that enjoin virtues of honesty, compassion, and
loyalty. And, ethical standards include standards relating to rights, such as the right to life, the
right to freedom from injury, and the right to privacy. Such standards are adequate standards of
ethics because they are supported by consistent and well-founded reasons.
Secondly, ethics refers to the study and development of one's ethical standards. As mentioned
above, feelings, laws, and social norms can deviate from what is ethical. So it is necessary to
constantly examine one's standards to ensure that they are reasonable and well-founded.
Ethics also means, then, the continuous effort of studying our own moral beliefs and our moral
conduct, and striving to ensure that we, and the institutions we help to shape, live up to
standards that are reasonable and solidly-based.
The World Wide Web (WWW), often called the Web, is a system of interconnected webpages
and information that you can access using the Internet. It was created to help people share and
find information easily, using links that connect different pages together. The Web allows us to
browse websites, watch videos, shop online, and connect with others around the world through
our computers and phones.
All public websites or web pages that people may access on their local computers and other
devices through the internet are collectively known as the World Wide Web or W3. Users can
get further information by navigating to links interconnecting these pages and documents. This
data may be presented in text, picture, audio, or video formats on the internet.
What is WWW?
WWW stands for World Wide Web and is commonly known as the Web. The WWW was
started by CERN in 1989. WWW is defined as the collection of different websites around the
world, containing different information shared via local servers(or computers).
Web pages are linked together using hyperlinks which are HTML-formatted and, also referred
to as hypertext, these are the fundamental units of the Internet and are accessed through
12 | P a g e
Hypertext Transfer Protocol(HTTP). Such digital connections, or links, allow users to easily
access desired information by connecting relevant pieces of information. The benefit of
hypertext is it allows you to pick a word or phrase from the text and click on other sites that
have more information about it.
It is a project created, by Tim Berner Lee in 1989, for researchers to work together effectively at
CERN. It is an organization, named the World Wide Web Consortium (W3C), which was
developed for further development of the web. This organization is directed by Tim Berner’s
Lee, aka the father of the web. CERN, where Tim Berners worked, is a community of more
than 1700 researchers from more than 100 countries. These researchers spend a little time on
CERN and the rest of the time they work at their colleges and national research facilities in their
home country, so there was a requirement for solid communication so that they can exchange
data.
System Architecture
From the user’s point of view, the web consists of a vast, worldwide connection of documents
or web pages. Each page may contain links to other pages anywhere in the world. The pages
can be retrieved and viewed by using browsers of which internet explorer, Netscape Navigator,
Google Chrome, etc are the popular ones. The browser fetches the page requested interprets
the text and formatting commands on it, and displays the page, properly formatted, on the
screen.
The basic model of how the web works are shown in the figure below. Here the browser is
displaying a web page on the client machine. When the user clicks on a line of text that is linked
to a page on the abd.com server, the browser follows the hyperlink by sending a message to
the abd.com server asking it for the page.
Here the browser displays a web page on the client machine when the user clicks on a line of
text that is linked to a page on abd.com, the browser follows the hyperlink by sending a
message to the abd.com server asking for the page.
Working of WWW
13 | P a g e
A Web browser is used to access web pages. Web browsers can be defined as programs
which display text, data, pictures, animation and video on the Internet. Hyperlinked resources
on the World Wide Web can be accessed using software interfaces provided by Web browsers.
Initially, Web browsers were used only for surfing the Web but now they have become more
universal.
The below diagram indicates how the Web operates just like client-server architecture of the
internet. When users request web pages or other information, then the web browser of your
system request to the server for the information and then the web server provide requested
services to web browser back and finally the requested service is utilized by the user who made
the request.
Web browsers can be used for several tasks including conducting searches, mailing,
transferring files, and much more. Some of the commonly used browsers are Internet Explorer,
Opera Mini, and Google Chrome.
Features of WWW
Uniform Resource Locator (URL): URL serves as a system for resources on the web.
Hyper Text Transfer Protocol (HTTP): HTTP specifies communication of browser and
server.
Hyper Text Markup Language (HTML): HTML defines the structure, organisation and
content of a web page.
14 | P a g e
Difference Between WWW and Internet
WWW Internet
Web Browser Evolution and the Growth of the World Wide Web
In the early 1990s, Tim Berners-Lee and his team created a basic text web browser. It was the
release of the more user-friendly Mosaic browser in 1993 that really sparked widespread
interest in the World Wide Web (WWW). Mosaic had a clickable interface similar to what people
were already familiar with on personal computers, which made it easier for everyone to use the
internet.
Mosaic was developed by Marc Andreessen and others in the United States. They later made
Netscape Navigator, which became the most popular browser in 1994. Microsoft’s Internet
Explorer took over in 1995 and held the top spot for many years. Mozilla Firefox came out in
2004, followed by Google Chrome in 2008, both challenging IE’s dominance. In 2015, Microsoft
replaced Internet Explorer with Microsoft Edge.
Conclusion
The World Wide Web (WWW) has revolutionized how information is accessed and shared
globally. It provides a vast network of interconnected documents and resources accessible via
the Internet. Through web browsers, users can navigate websites, access multimedia content,
communicate, and conduct transactions online. The WWW has transformed communication,
commerce, education, and entertainment, shaping modern society and facilitating a connected
global community. Its continued evolution and accessibility drive innovation and connectivity
worldwide.
15 | P a g e