CSCU Module 06 Internet Security.pdf

Internet Security Module 6

Simplifying Security.

1

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

May 18, 2011 1:15 AM CDT

Our View: Bolstering Internet Security Is Imperative On Monday, the Obama administration proposed a much‐needed international effort to bolster the security of the Internet. It’s needed because cyberspace has come to serve as both a communications miracle and, potentially, one of the greatest threats to our security in the 21st century. That description may seem like hyperbole as it pulls in two completely different directions. But there are justifications for both descriptions. The Internet is arguably the greatest technological breakthrough introduced to our society since the television. Perhaps that’s more hyperbole, unless you consider just how much of our world now is tied to online access and interconnectivity. The 2010 census noted that 68.7 percent of all U.S. households have Internet connections; a vast majority of businesses also use the Web for marketing or for inventory purposes, among other tools. Cyberspace has become a staple in our lives, even if you don’t have an Internet connection in your home or office. Our banking, our medical records, our credit and our businesses are all linked in some form to the Web. So, too, is much of our infrastructure, our communication and our national security. Odds are, there is something you want, rely on or need each day that is dependent on Internet connectivity for you to have it. That may not be a game‐changer in terms of how you live your life, but it’s definitely a sobering impact.

http://www.yankton.net

2


Module Objectives Internet Security

Online Gaming Risks

Internet Explorer Security Settings

Security Practices Specific to Gaming Child Online Safety

Mozilla Firefox Security Settings

Role of Internet in Child Pornography

Google Chrome Security Settings Apple Safari Security Settings

Protecting Children from Online Threats

Instant Messaging (IMing)

How to Report a Crime?

Searching on the Web

Internet Security Laws

Online Gaming and MMORPG

Internet Security Checklists

3


Module Flow

Browser Security

Search Engine and IM Security


Online Games

Child Online Safety

4


Internet Security Internet security involves protecting user data from unauthorized access and damage when connected to the Internet A proper browser configuration helps in preventing malware infection, protecting personal information, and preventing or limiting the damage from an cyber attack

Top 10 Malware Hosting Countries 39%

United States

France

10%

Russia

8.72%

Germany

Online attack paths:

5.87%

China



Emails



Instant messaging



Chat rooms

Poland



File sharing and downloads

Canada

5.04%

United Kingdom

2.68% 2.43% 2.03%

Ukraine

1.97%

Hungary

1.84%

http://www.findmysoft.com

5


Internet Explorer Security Settings Launch Internet Explorer, click the Tools button, and select Internet options Select the Security tab, which displays websites classified into four zones: 1. Internet 2. Local Intranet 3. Trusted sites 4. Restricted sites

6


Internet Explorer Security Settings: Internet Zone The Internet zone is for all the Internet websites except for those listed in the Trusted or Restricted zones Click Custom level to set the Internet zone security settings Disable or enable the required options Move the slider to change the security level Set the security level for the zone High to ensure higher security Maintaining the higher security level may degrade the performance of the browser Click OK to apply the settings

7


Internet Explorer Security Settings: ActiveX Controls ActiveX controls are small programs that work over the Internet through the browser They include customized applications that are required to gather data, view select files, and run animations when the user visits websites Malware is downloaded onto the user system through ActiveX controls when he/she visits malicious websites Disable the ActiveX controls and plug‐ins options in the Security Settings window Enable the Automatic prompting for ActiveX controls option so that the browser prompts when there is a requirement of ActiveX controls and plug‐ins to be enabled Click OK to apply the settings

8


Internet Explorer Security Settings: Local Intranet Zone Local intranet zone covers the sites on intranet Steps to add websites to Local intranet zone:  Select Security  Local Intranet  Click Sites  Click the Advanced button  Enter the URL into Add this website to the zone column and click Add  Click OK to apply the settings

9


Internet Explorer Security Settings: Trusted Sites Zone The Trusted sites zone contains those websites that the users believe will not damage their computers or data

 Select Security  Trusted sites  Click the Sites button  Enter the URL into Add this website to the zone column and click Add  Click OK to apply the settings

10


Internet Explorer Security Settings: Restricted Zone The Restricted sites zone restricts the access to the websites that might cause damage to a computer To add restricted websites to Restricted sites zone:  Select the Security tab and choose Restricted sites  Click the Sites button  Enter the site URL into the Add this website to the zone column to restrict the access  Click Add and then click OK to apply the settings

11


Understanding Cookies A cookie is information that is provided by a web server to web browser and then sent back unchanged by the browser each time it accesses that server When the website is revisited, the browser sends the information back to it to help recognize the user This activity is invisible to the user and is generally intended to improve the web surfing experience (for example, at an online store)

12


Internet Explorer Privacy Settings The user can limit the information that is stored in a cookie A cookie is only a text file and cannot search a drive for information or carry a virus To configure cookie settings:  Choose Internet options from the Tools menu on the browser  Select the Privacy tab and use the slider to set the level at low, medium, medium‐high, or high  Block all or accept all cookies depending upon the requirement  Check the Turn on Pop‐up Blocker option to block the pop‐ups that appear while visiting some websites

13


Deleting Browsing History 1. Choose Internet options from the Tools menu on the browser 2. Go to the Browsing history section 3. Check the desired options in the Delete Browsing History dialog box 4. Click Delete to delete the browsing history

14


Do Not Allow the Browser to Remember any Password Internet Explorer Autocomplete Password prompt

Firefox Remember Password prompt

15


Securing File Downloads To configure the download settings for Internet Explorer, navigate to Tools  Internet options  go to Security tab Click the Custom Level button in the Security Settings window In the Downloads menu Enable the Automatic prompting to File downloads and File download options Click OK to save the settings

Setting Download options in Internet Explorer 16


Mozilla Firefox: Security Settings Launch the Mozilla Firefox browser Click the Tools menu item and select Options

17


Mozilla Firefox: Security Settings Select Security from the Options window

Check the option Warn me when sites try to install add‐ons so that the browser prompts before installing add‐ons to the browser Click the Exceptions button and enter the URL into Address of Website box and click Allow to specify which websites are allowed to install add‐ons Check the Block reported attack sites option to avoid visiting malicious websites Check the option Block reported web forgeries to actively check whether the site being visited is an attempt to steal personal information Uncheck the Remember passwords for sites option to prevent the browser from remembering the passwords for the login pages visited

18


Mozilla Firefox: Privacy Settings Select Privacy in the Options window

The user can choose if Firefox remembers the browsing history

Click clear your recent history

Select the Time range to clear the history Check the options required to clear the history and click Clear Now

19


Securing File Downloads Do not accept file downloads from unknown members on the Internet  These downloads may contain malware that will degrade computer performance

File are downloaded by default to My Documents  Downloads  The user may configure the browser settings so that he/she is prompted to specify the location to save the file

20


Securing File Downloads

To configure the download settings for Mozilla Firefox, navigate to Tool  Options  General Check the option Always ask me where to save the file to allow the browser to ask before downloading a file and to specify the location to which it will be downloaded Setting Download options in Mozilla Firefox

21

The browser directly downloads the file to the default location without any intimation if this option is unchecked


Installing Plugins 1

The Install Missing Plugins message appears while opening some websites

2

Plug‐ins are required to display files, graphics or play a video on a webpage

3

Check if the source of missing plug‐ins is trustworthy or not

4

Scan the downloaded plug‐in using an antivirus software before installing it

22


Google Chrome Privacy and Security Settings

Launch Google Chrome

Click the icon, then select Options

23


Google Chrome: Privacy Settings

Click the Under the Hood tab in Google Chrome Options window Under Privacy, check the desired web services Check the Use DNS pre‐fetching to improve page load performance option DNS pre‐fetching stands for Domain Name System pre‐fetching  When the user visits a webpage, Google Chrome can look up or pre‐fetch the IP addresses of all links on the webpage

Check the option Enable phishing and malware protection to prevent the browser from opening any malicious websites

24


Google Chrome: Security Settings Secure Sockets Layer (SSL) is an Internet protocol used by many websites to ensure safe data encryption and transmission The SSL setting in web browsers is turned on by default Some websites require older version of SSL 2.0; check the Use SSL 2.0 option in such conditions Check the check for server certificate revocation option to turn on real‐time verification for the validity of a website's certificate

25


Apple Safari: Security Settings Launch the Safari browser To change the settings, select the icon and then select Preferences

26


Apple Safari: Security Settings  Select the Security tab in the preferences window  The Web Content section permits the user to enable or disable various forms of scripting and active content  It is recommended to accept cookies only from the sites visited  Checking this option allows the browser to warn the user before opening any website that is not secure

27


Testing the Browser for Privacy Launch the Internet browser and navigate to http://privacy.net/ analyze/ to test the privacy Click Click here to take the browser test and analyze the privacy of your Internet connection

28


Module Flow

Browser Security



Online Games

Child Online Safety

29


Instant Messaging (IMing) Instant Messaging (IMing) allows the user to interact with other people on the Internet using a software application

30


Instant Messaging Security Issues IMWorm 

A worm that harms the computer and locates all the contacts in the IM address book



The IMWorm tries to send itself to all the contacts in the user’s IM contact list

Social Engineering 

Social engineering depends on human interaction that involves tricking people through IM and getting their personal information

Spam over IM( SPIM) 

SPIM is spam delivered through IM instead of delivering it through email



IM systems such as Yahoo! Messenger, AIM, Windows Live Messenger, and chat rooms in social networking sites are popular targets for spammers

31


Instant Messaging Security Measures Do not reveal personal information on IMs

Do not accept links received from unknown people on IM

Block the users who send unsolicited web‐links

Always use strong passwords

Sign out of the IM application after using it

Do not check the Remember password option

32


Searching on the Web Search engines display hundreds of results for a search query

Not all the web page results obtained by the search engine are secure

To filter the malicious search results, use an antivirus application as an add‐on to the browser and Enable it

To add Add‐ons in the Mozilla Firefox browser, navigate to Tools Add‐ons  Get Add‐ons

33


Module Flow

Browser Security



Online Games

Child Online Safety

34


Online Gaming and MMORPG Online gaming has become a popular pastime, especially due to high‐speed Internet and emerging technology MMORPGs are popular worldwide and the revenues for these games are well over a billion dollars

Massively Multiplayer Online Role‐ Playing Game (MMORPG) is a type of computer role‐playing games in which a large number of players interact with one another within a virtual game world

It has also become the target for attackers for the large amounts of money involved

In the world of MMORPGs, also known as online games, players can meet other players, become friends, engage in a battle, fight against evil, and play

35


Online Gaming Risks Interactions with potential fraudsters who may trick the gamer to reveal personal/financial information

Computer intruders exploiting security vulnerabilities

Malware such as viruses, Trojan horses (Trojans), computer worms, and spyware

Online and real‐world predators

36


Insecure or Compromised Game Servers and Game Coding If the software at the game server is compromised, the computers that are connected to the server can also be compromised Any game with a network connection has a risk involved The attacker may even use the vulnerabilities to crash the gaming server The vulnerabilities in the game server can be used by the attackers to:  Steal game passwords  Steal information from the gamers’ computers  Control the gamers’ computers remotely  Launch attacks on other computers  Install programs such as Trojans, adware, spyware

The game code is generally not as well analyzed as the other software coding This may result in introducing unknown vulnerabilities onto the computer 37


Social Risks The attackers may use the social interaction in the online game environment to attack the unprotected computers or to exploit security vulnerabilities

Social Engineering

Virtual Mugging

Identity Theft

Cyber Prostitution Protection Schemes

38


Social Engineering Attackers may trick the gamers into installing malicious software on their computers by social engineering They offer a bonus or help in the game in exchange for other players’ passwords or other information in the game forums on a game server

The gamers who are looking for ways to make the play easier respond to such offers Attackers send phishing emails supposedly from the game server administrators, which will invite the player to authenticate his/her account via a website linked in the message

Note: Game Masters (GMs) of a game will never ask a gamer for his/her username and/or password

39


Message from a Gamer About a Password Stolen by a Malicious Program

http://www.securelist.com

40


Protection Schemes, Cyber Prostitution, and Virtual Mugging Protection Schemes

Organized crime has emerged in South Korean gaming community The criminal organizations force the gamers into protection schemes, where the gamers have to pay money (virtual or real) to avoid killing of the gamers’ characters and theft of the passwords

Cyber Prostitution

Online games are being used for cyber prostitution where the customers/gamers pay money for cybersex In The Sims online, a Massively Multiplayer Online (MMO) game, a 17‐ year‐old developed a cyber “brothel”, where the gamers paid Sim‐money (Simoleans) for cybersex per minute

Virtual Mugging

Virtual mugging was coined when some players of Lineage II used bots to defeat other gamers and take their items; these items were later put on sale in online auctions

The gamers’ accounts were eventually cancelled

41


How the Malicious Users Make Money Stolen items such as passwords or virtual items are put on sale on websites, such as eBay, or on forums These are sold to other gamers for real or virtual money The cyber criminal may ask the gamer for ransom in return for this information

http://www.securelist.com 42


Security Practices Specific to Gaming

43


Recognize Administrator Mode Risks

Some games require the game to be run in Administrator mode  If that is the case, ensure that the game has been downloaded from a trusted website/vendor

1

Free downloads of games may contain malicious software, including plugins to run the game  This software may be used to gain administrator level control of the computer

Instead of using the administrator account, the gamer is advised to browse the Internet or play the games using a User Account, which may deny the attacker access to administrator rights

2

3

44


Recognize Risks due to ActiveX and JavaScript

Some of the games played over the web require ActiveX or JavaScript to be enabled

45


Play the Game, Only at the Game Site

Play the games at the game site and save the Internet browsing for later

Once done with playing the game, switch to the user account to browse the Internet

46

This reduces the risk of visiting a malicious website when playing a game


Pay Attention to Firewall Management Playing certain multiplayer games may require the firewall settings to be changed to allow information from the game to get through to the gamers’ computers

Every time the permissive settings are changed on the firewall, the risk of computer security concerns increases

In the firewalls, the gamer can designate the fellow gamers’ IP addresses as trusted to avoid any interactions with the attacker

47


Module Flow

Browser Security



Online Games

Child Online Safety

48


Risks Involved Online The risks involved when a child works online include: Misdirected searches Stealth sites and misleading URLs Online sexual harassment  Child pornography  Grooming  Cyberbullying

49


Misdirected Searches 1

Parents may take all the precautions to protect the child online, but all that could be negated when the child is unconsciously led to visit harmful sites

2

Search engines use terms known as “meta variables” to index a website

3

When a user searches for websites, the search engines display the results using the meta variables Example: a sports website may be indexed by the meta terms “soccer”, “football”, “scores”, etc.

4

Porn site promoters add popular search terms to their meta variable list, to redirect the web traffic towards their site

5

Porn sites may use the words “sports”, “school”, “movies”, etc., to lure children to their websites

6

Unless a filtering software is used, the search engines cannot distinguish between the search requests of an adult and a child

50


Stealth Sites and Misleading URLs Pornographic websites thrive on increased web traffic

Pornographic sites use common typo errors to lure visitors to their websites

Children may end up at a pornographic website just by typing “www.whitehouse.com” instead of “www.whitehouse.gov”

Porn site promoters buy domain names such as the “.com” equivalent of a “.gov” or a “.org” website, being aware that web surfers would end up at their website if there is a typographical error

51


Child Pornography, Grooming, and Cyberbullying Child Pornography “Under federal law (18 U.S.C. §2256), child pornography is defined as any visual depiction, including any photograph, film, video, picture, or computer or computer‐generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where the production of the visual depiction involves the use of a minor engaging in sexually explicit conduct”

Grooming “Grooming” is an act of befriending and establishing emotional connection with children Child grooming is used for lessening the child’s inhibitions and preparing them for child abuse The offenders target children through attention, affection, kindness and sympathy, and offer gifts and/or money

Cyberbullying Cyberbullying occurs when a child, preteen or teen, is threatened, harassed, and/or embarrassed using the Internet or mobile phones or other communication media Cyberbullying signs:  Upset after using the computer  Refuse to step out of the house or to go to school  Draws away from friends and family

‐http://www.missingkids.com

52


Role of the Internet in Child Pornography The Internet provides easy access to huge quantities of pornographic materials

It ensures complete anonymity and privacy Various web services such as emails, newsgroups, and chat rooms facilitate the sharing of pornographic materials It provides a cost‐effective medium for the transfer of pornographic materials It enables people with an Internet connection to access pornographic materials at any time and anywhere It supports transfer of pornographic materials in various formats that can be stored on different digital storage devices

53


Effects of Pornography on Children

They experience mental weakness such as:

Child victims suffer from depression, anger, withdrawal, and other psychological problems

 Guilt and feeling responsible for the abuse and betrayal

Physical injuries due to molestation, such as genital bruising or exposure to sexually transmitted diseases

 A sense of powerlessness and worthlessness  Low self‐esteem

54


Risks Involved in Social Networking Websites People on the social networking websites can view the profiles, photos, and videos of other people on that website

The child may provide too much information on a social networking website Online predators may get information such as email IDs, telephone numbers, residential address, hobbies, interests and more from their profile Online predators may use this information for cyberbullying, identity theft, or cyber exploitation

55


Unsolicited Emails Online predators may use email techniques to steal information from children

They may send spam emails that contain pornographic materials or links to pornographic websites

The child may even be asked to register on that website by providing personal information

56


Chat Rooms Online predators may use chat rooms to build contacts with children and then lead them into cyber prostitution Online predators may use social engineering techniques to get personal information from children in a chat room

They may also use chat rooms to sends links to websites with inappropriate content, such as pornography They may also send malicious links to children, which may result in the computer getting infected with malware

57


Finding if Children are at Risk Online The parent can find if their children are facing any online threats from the following symptoms:

The child spends more time sitting at the computer

Pornographic material is present on the child’s computer

The child receives phone calls and/or gifts from unknown persons

The child turns off the monitor or quickly changes the screen when the parent enters their room

The child looks depressed and does not show any interest in talking with family or friends

58


Protecting Children from Online Threats Ensure that the child knows about dangers of computer‐sex offenders

Check credit card statements each month for any unusual charges that may indicate unauthorized purchases by a stranger or your child

Monitor what the child does on the computer

Notify the police if someone the child met online starts calling them, sends gifts, or trying to lure them for revealing sensitive information

Use caller ID on phones to determine who is calling the child, and block numbers that are suspicious Monitor the child's access to all types of live electronic communications such as chat rooms, instant messages, Internet Relay Chat, etc.

Ensure that the child does not: 

Provide personal information such as name, address, phone, school name

Restrict access to the malicious and porn websites using Internet content filtering software



Meet anyone online without permission



Open emails from unknown senders

If the child is maintaining a social networking profile, look closely at what information they have posted in their member profiles and blogs, including photos and videos



Share their photos/videos with strangers over the Internet

59


Encourage Children to Report The parents should encourage their children to report any inappropriate behavior they may face online

The parents can encourage the child to come to them if they are being bullied or are facing online predators The children may also be encouraged to speak to a trusted individual such as an aunt, uncle, or older sibling, if they are uncomfortable talking to the parents

60


How to Report a Crime

Internet crimes can be reported at http://www.ic3.gov/comp laint/default.aspx by clicking Report Internet Crime

http://www.ic3.gov 61


Security Software for Protecting Children from Online Threats Children can be protected from online threats by installing appropriate security software on the child’s computer The features that a parent should look for in the software include: IM features

Web blocking To help prevent the child from viewing inappropriate content

To help in recording and monitoring the IM chats of the child, thus help the parent in determining if the child is engaged in an inappropriate dialogue with unknown persons

Program blocking

Usage reports

To help block games, peer‐peer file sharing, etc.

To provide a timely report on the child’s Internet usage and IM history to monitor the child’s online interactions

Email blocking

Video filtering

To help block unknown email addresses and prevent children from communicating with people they met online, through email

To ensure that the child does not view inappropriate videos on sites such as YouTube, but at the same time allow the child to view useful/fun videos

Social networking features

Time limits

To help in recording and monitoring the content that the child posts online, and to determine if the child is being bullied online

To help control the amount of time the child spends on the computer

62


KidZui KidZui is a free web browser, search engine, and online playground for kids It has a large number of games, websites, videos, and photos reviewed by parents and teachers It eliminates the need for parents when kids are online

http://www.kidzui.com

63


Actions To Take When the Child Becomes an Online Victim Ignore any contact from the online predator or cyberbully

Report the offense to the Internet Service Provider (ISP)

Encourage the child not to log into the website where bullying occurred

Also report to the offender’s ISP

Change the online information of the child and delete the social networking accounts if necessary

Block the offender’s email address and screen name so that they cannot contact the child anymore

64


Module Flow

Browser Security



Online Games

Child Online Safety

65


Internet Laws The web space is a vast terrain and with plethora of e‐commerce sites, analytical sites, sports sites, information sites, business sites, etc. Such a large domain requires supervision to protect the netizens from Internet criminals, attackers, etc. Internet laws protect the users from immoral/indecent acts, privacy breach, etc., on the Internet Why you need to know Internet laws: Internet users should know the Internet laws to leverage the disputes against e‐commerce vendors, fraudsters/Internet criminals, etc., Knowing the Internet laws helps the users to understand what they can and cannot post on the Internet

Internet laws cover:

Important laws:

Defamation

USA PATRIOT Act

Intellectual property

Children’s Online Privacy Protection Act (COPPA)

Patents Copyrights Privacy infringement Child protection, etc.

Also, users need to know the Internet laws to be able to legally use the immense content present on the Internet

The Digital Millennium Copyright Act CAN‐SPAM Act Computer Misuse Act 1990 European Union Data Protection Directive Data Protection Act 1998

66


USA PATRIOT Act USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism, USAPA),was passed on October 26, 2001

Section 212 of the act allows the ISPs to voluntarily disclose the customer information including the customer records and all electronic transmissions (email, voice transmissions)

TITLE II‐Enhanced Surveillance Procedures, section 216 of the Patriot act, gives law enforcement authorities access to dialing, routing, and signaling information

The ISPs may choose to reveal the customer information if they believe that there is risk of death or bodily injury to an individual/group

According to the act, law enforcement authorities have access to the email packets (includes email content)

Section 220 of the act allows for nationwide search warrants for email  This gives the authorities the right to search a suspect without having to go to the place of the ISP

Under the act, the government can compel the ISP to release the subscriber information that includes:  Customer name  Customer address  Mode of payment  Credit card information  Bank account information

67


Children’s Online Privacy Protection Act (COPPA) The COPPA is relevant to the online collection of personal information from children below the age of 13 The act dictates:

The privacy policy should include: The name and contact information of all the operators collecting/maintaining the personal information The kind of personal information that will be collected

What a website owner must include in the privacy policy

How the operator intends to use the personal information Whether the operator releases the personal information to third parties

When and how the verifiable consent can be requested from the parents

If the parents’ consent is required for releasing the information to third parties

The responsibility of the website owner in protecting the children’s online safety and privacy

The procedure that the parents should follow to control their children’s personal information

Every operator of a website or online service who collects the personal information of children, knowingly, must comply with COPPA The operator must include a link to the privacy policy of the website on the home page

According to the act, the operator should: Notify the parents that he/she intends to collect their children’s information Ask for the parents’ consent before releasing the information to the third parties/public disclosure Inform the parents about the internal use of the personal information Inform the parents if there are any changes in the privacy policy

68


The Digital Millennium Copyright Act The European Union Copyright Directive (EUCD) addresses some of the same copyright infringement issues as the DMCA

The Digital Millennium Copyright Act (DMCA) 1998 was signed into law by President Clinton

According to the act, any infringement of the copyrighted material is a criminal offense

69


Highlights of DMCA Circumventing any anti‐piracy measures built into commercial software is a crime

Bans the production, sale, or distribution of code cracking tools to illegally copy software Permits the cracking of copyright‐protected software to perform encryption research and test computer security systems Nonprofit libraries, educational institutions, etc., are exempted from the act under certain circumstances ISPs are exempt for simply transmitting information over the Internet

ISPs are, however, required to remove the copyright‐infringing materials from user websites

Webcasters are required to pay licensing fee to the recording companies

70


CAN-SPAM Act Requirements

The CAN‐SPAM act was signed into law by the U.S. President George W. Bush on December 16, 2003

Do not use false or misleading email header information

The act establishes the standards for sending commercial email

If the message is an advertisement, you are required to disclose it clearly

The CAN‐SPAM act: Defines the rules for commercial email Establishes the requirements for commercial messages

You should tell the recipients how they can opt out of receiving further emails from you

Gives recipients the right to have the sender stop emailing them

You should honor the recipients opt‐ out request within 10 business days

Each email that violates CAN‐SPAM act is subject to penalties of up to $16,000

If a third party is sending emails on your behalf, monitor what they are sending to the recipients

71


Computer Misuse Act 1990 The Computer Misuse Act 1990 is an act of the UK Parliament

The act makes certain activities illegal such as:

The act defines three computer misuse offenses:

Hacking into other users’ computers

Unauthorized access to computer material

Misusing software

Unauthorized access with intent to commit or facilitate commission of further offenses

Helping an attacker gain access to secured files/documents in another user’s computer

Unauthorized modification of computer material

72


European Union Data Protection Directive (95/46/EC) The 95/46/EC directive provides guidelines to European Union member states for individuals’ privacy and data protection

The directive regulates the processing of personal data regardless of whether such processing is automated or not

Section 1of the directive provides the principles relating to data quality, section 2 provides criteria for making data processing legitimate and section 5 defines the data subject's right of access to data According to section 1 of the directive, Member States shall provide that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes Section 2 states that Member States shall provide that personal data may be processed only if the data subject has unambiguously given his consent

Section 5 states that Member States shall guarantee every data subject the right to obtain from the controller without constraint at reasonable intervals and without excessive delay

73


Data Protection Act 1998 (UK) Right To Privacy

Personal Data Data Protection Act 1998 defines UK law on the processing of data on identifiable living people and is the main piece of legislation that governs the protection of personal data in the UK

It protects people's fundamental rights and freedoms and in particular their right to privacy with respect to the processing of personal data

Explicit Consent

Authorization

Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information

It is an offence for other parties to obtain this personal data without authorization

74


Module Summary  Internet security involves protecting user’ data and information from unauthorized access when connected to the Internet  Scan the file downloads with updated antivirus software to check for the presence of malware  Online gaming has become a popular pasttime, especially due to high‐speed Internet and emerging technology  If the software at the game server is compromised, the computers that are connected to the server can also be compromised  Parents may take all precautions to protect the child online, but all that could be negated when the child is unconsciously led to visit harmful sites  Children can be protected from online threats by installing appropriate security software on the child’s computer  Internet laws protect users from immoral/indecent acts and privacy breach on the Internet  Knowing the Internet laws helps the users to understand what they can and cannot post on the Internet

75


Internet Security Checklists Regularly update your operating system and other installed applications Set up a firewall to control the flow of information

Ensure that you have the latest web browser installed on the system and update it regularly Install a safe browsing tool that warns about reported phishing sites and blocks access to the addresses Ensure that you are connected to a secured network when using a wireless network Never respond to unsolicited email offers or requests for information

76


Internet Security Checklists Do not click the links sent by unknown users Do not download files from unknown sources Do not give out personally identifiable information when registering with websites/applications Do not click any pop‐ups that appear while browsing websites Regularly scan your system for viruses, worms, Trojans, spyware, key loggers and other malware using antivirus Update the antivirus application on a regular basis

77


Internet Security Checklists Use strong passwords and change them at regular intervals Disconnect from the Internet if anything suspicious is found on the computer Always check the Address bar for correct URL Always check the website certificate, SSL padlocks and HTTPs Do not enable ActiveX and JavaScript features Regularly back up the important files Remove unnecessary protocols from the Internet interface Check router or firewall logs to identify abnormal network connections to the Internet

78


Checklist for Parents to Protect Their Child from Online Threats Talk to children about what they do on the computer

Get a profile on the social networking site the child is on

Review the list of the child’s friends

Be informed of the challenges of social networking

Check if anyone is trying to impersonate the child online

Encourage the child to use the child safe applications such as KidZui

79


CSCU Module 06 Internet Security.pdf

Recommend Documents