1. CPT 499 Internet Skills for Educators

2. Internet Security Why security Server software security problems Server software security solutions Security Policies

3. Internet Security Anyone connected to the Net should be concerned about data security and the safety of their system Internet has surpassed two million reachable hosts Number of users unknown

4. Internet Security Most Internauts are well-behaved Yet there does exist ill-behaved and malicious users within the large Internaut population Individual user that runs Internet clients seldom has anything to be concerned about

5. Internet Security The office network; business networks; and government networks, on the other hand, have much to be concerned about when it comes to legacy data on their systems Their systems could come under an INTERNAUT ATTACK There is hope

6. Internet Security In the nut shell, security is the process of keeping anyone from doing things you don’t want them to do to with, on, or from computers or peripheral devices Determine what resources need to be protected

7. Internet Security Now computers running software with sensitive legacy data is a resource to protect Software with configuration files may contain sensitive information must be protected

8. Internet Security A hacker, cracker, or attacker who compromises or impersonates a host will have access to all of its resources: files, hard drives, etc.. Internaut attackers may be more interested in the laundry further ongoing connections to other more targets.

9. Internet Security Defining what needs protecting in general dictates the host-specific measures needed Machines running sensitive files may need extra levels of passwords, file encryption, a password policy, etc..

10. Internet Security If the target is network connection, the network administrator may ask for certain privileges to access the network When these privileges are activated, extra logging activities may take place on the system Sometimes if you want to protect all resources Internaut attackers must be stopped at the front door

11. Internet Security Not all attacks come from the outside Must define who the system must be protected from Different levels of attacks require different levels of security

12. Internet Security Security against a teenager with a modem may not be good enough for an intelligent, malicious, dedicated group of individuals For the teenager an enhanced password system may do the job For the others wiretapping, cryptanalysis, or monitoring the electronic emissions of computers and wires may be needed

13. Internet Security The security defenses are proportional to the value of the resources and assets to be protected Yet the cost of security on the system is also a factor Some systems may require extra routers or computers to build a firewall gateway

14. Internet Security There is also the cost of training or hiring individuals to administer the security, develop security software, or to buy security software Too much or too little can hurt a system Keeping hackers, crackers, or attackers off your system depends on how assets are valued

15. Internet Security An Internaut attacker that enters the system will be able to send nasty notes or data from the system, using a legal user ID or may use the system to enter other systems pretending to be one of the systems users

16. Internet Security Due to the dynamic nature of the environment server software is often developed rapidly and has not passed rigorous security testing and may have serious vulnerabilities Yet, there are tools and protocols to protect the system from being compromised

17. Internet Security Yes, the largest threat exists when you decide to serve information on the Internet When an information server is placed on the Internet, it should reside in a system designed and dedicated solely for such a purpose Only information to be distributed should reside on that system

18. Internet Security Make the assumption that information on the system will be available to the Internet public Therefore, the server system should be disconnected from the rest of a systems network to provide minimum security exposure

19. Internet Security Not always practical therefore a firewall or a firewall gateway may be necessary A firewall gateway is to serve the line of trust at certain key points It trust only a few other machines and only for certain functions

20. Internet Security A firewall is a perimeter defense Firewalls do not provide any protection once an Internaut attacker has passed them A firewall is one or more components of a network that permits only authorized inbound and outbound traffic

21. Internet Security Firewalls have a higher security profile than any other component on the network A firewall usually sits between the Internet and the local network It provides extensive tools to enforce a security policy and is meant to screen client and server request

22. Internet Security Policy A security policy is a set of enforced rules and behaviors that applies to people and systems Policies should be considered by all Internet users Single-user computers Large Organizational LANs

23. Internet Security Policy Security policies vary according to type of user organizations Some organizations have unrestricted access policies Other organizations have very restrictive policies

24. Internet Security Policy Single user should be aware that the system is secure if no Internet server applications are loaded Most Internet Service provider’s have extensive security policies and are capable of serving data without exposure

25. Internet Security Policy If service provider provides server applications, single user preserves the security level of client computer Thus security for single user not necessary For organization password policies and security standards are necessary

26. Internet Security Policy Commonly used security policies Least restrictive policy - permit all users to access all resources - used for years on the Internet - can be disastrous - mainly academic or scientific communities

27. Internet Security Policy Trusted access requires password access and authentication for every resource - requires careful design and time to implement - requires encrypted verification and passwords for all inbound and outbound traffic - purpose to ensure information not transmitted to or from an unsecured location

28. Internet Security Policy No access - defeats the purpose of Internet attachment - organizations not attached to the Internet by default implement this policy - several commercial organizations are not connected to the Internet

29. Internet Security Policy Commercial organizations, government agencies, and military establishments need a highly structured security policy Academic and scientific communities need cautious policies Single users need to think about the policy they want to follow

30. Internet Security Policy Every organization has more than one exposure point concerning security if the are connected to the Internet Organizations need to determine exposure points and establish these areas as the focus of security policy

31. Internet Security Policy Typical areas of focus Network security - the goal is to prevent any unauthorized entry into the system Physical protection of hardware - the goal is to physically secure computers and develop a tracking system for equipment assigned to individuals within the organization

32. Internet Security Policy Access rules and regulations - establish who may and may not enter specified areas of the computer network Virus protection - includes methods for keeping the protection against the latest viruses up-to-date

33. Internet Security Policy Disaster recovery - requires planning for major shutdowns or loss of computer capability or file storage due to extended power outages, severe weather such as floods, tornadoes, and earthquakes Backup plans - the goal is to preserve critical information

34. Internet Security Policy Steps in developing a security policy determine what needs protection determine who should and should not have access to protected areas and at what level determine how protection will occur draft and approve a policy implement a policy maintain and update the policy

35. Internet Security Policy Security is the act of protecting computer resources and data from unwanted access and use Security risks come mainly from inside organizations but can also come from Internaut hackers, crackers, and attackers

36. Internet Security Policy In addition to system Internaut attackers, computer systems need protection from viruses Viruses rob computer resources and destroy valuable data

37. Internet Security Policy Methods of protecting involve the use of firewalls, user identification and authentication, and encryption Firewalls establish barriers to system entry from inside as well as outside Firewalls can be broken down into three generations of firewalls

38. Internet Security Policy Packet-filtering systems Bastion hosts Proxy gateways and stateful inspection Identification and authentication identification is the process of obtaining information from the user to determine authorization

39. Internet Security Policy Authentication is the process of the system establishing the identity of users asking for entry into the system Passwords, user Ids are identification techniques Smart cards and biometrics are authentication techniques Digital Ids or certificates us both techniques

40. Internet Security Policy Encryption uses a mathematical formula to code or scramble data for transmission over the Internet Receiving end decodes using a “key” that solves the mathematical problem and reassembles the message

41. Internet Security Policy Virus protection uses special software designed to detect and protect a computer system from viruses New viruses develop daily so organizations must continually monitor new viruses and adapt the virus protection software to keep pace