Security
Framework
Privacy on Internet
It
is the privacy and security level of data published via internet. It is also
referred as online privacy. It is necessary to make an online purchase, visit a
social networking site, participate in online games or attend forums. If a
password is compromised and revealed a victim’s identity maybe fraudulently
used or stolen. Privacy of internet helps us to protect the data and secure it
while communicating through internet. It is broad term that refers to a
varieties of factors, techniques and technologies used to protect sensitive and
private data, communication and preferences. Internet privacy risk
includesphishing, spyware, malware, pharming.
Some
of the measures to minimize internet privacy risks are as follows:
–
Always
use preventive software applications like antivirus, antimalware, antispam and
firewalls
– Avoid accessing and
shopping on unreliable websites
– Avoid exposing personal
data on website with lower security level
– Clear the browsers cache
and browsing history regularly
–
Always
use very strong passwords consisting of letters, numerals and special
characters
Computer Crime
It
refers to crimes or illegal activities performed by a knowledgeable computer
user to steal a companies or individual’s private information. Here a computer
or a network is the source, tool, target or place of crime. In some cases the
person or group of individuals may be malicious and destroy or corrupt data and
information present in a computer system while committing such crime.
Cyber Laws: It is a set of rules and
laws to be followed by computer user to minimize computer crime. It consists of
several protocols to govern the user of computer system and its resources.
Types of Cyber Crime
Ø Hacking
Hacking is the act of intercepting different
messages that moves in the network without the knowledge of user.
Ø Identity Theft
It is the act of stealing someone’s identity in
which someone pretends to be someone else by assuming that person’s identity,
in order to access resources and other benefits in that person’s name.
Ø Computer Viruses
It is a type of malware that replicates by
inserting copies of itself into other computer programs, data files or boot
sector showing various negative effects in the performance of computer system.
Ø Phishing
It is a technique of fraudulently obtaining
private information. Typically a phisher sends an email that appears to come
from legitimate business, a bank or credit card company requesting verification
of information and warning a some consequences if not provided.
Ø Cyber Stalking
It is the act of making an individual or a group
of individual or an organization stalk or harassed. It may include the making
of false statements of fact, making threats, identity theft, damage to data or
equipment or gathering information that may be used to harass.
Ø Intellectual Property Infringement
It is an violation of an intellectual property
rights like copyrights, patents and trademarks.
Ø Cyber Terrorism
Hacking, threats and blackmailing towards a
business or person.
Ø Denial of Service (DoS) Attack
Overloading a system with so many request so
that it cannot serve normal request.
Ø Pornography
Making or distributing porn videos and contents
in an illegal way.
Ø Salami Slicing
Stealing tiny amount of money from each
transaction.
Threats
A
computer is threats is a possibility of a danger that might have computer and
its components and breach the security to cause damage. It can have an
intentional cause like hacking or an accidental cause of natural disaster or
computer malfunction. Anyone with the capability, technology, opportunity and
intent to harm the computer system can create threats. There are several types
of threats which are:
a)
Intellectual Property
Threats
Use of existing material found on the internet
without owners permission.
b)
Client Computer Threats
Trojan Horse, Viruses, Active Contents
c)
Communication Channel
Threats
Sniffier programs, sniffer program, spoofing and
DoS
d)
Server Threats
(Privilege Setting Threats, Server-Side
Include(SSI), Common Gateway Interface (CGI), File Transfer, Spamming)
Privacy Software
Privacy
software is built to protect the privacy of its user. The software typically
works in conjunction with internet uses to control or limit the amount of
information made available to third parties. The software can apply encryption
or filtering process. A privacy software can be referred to two types of
protection:
a) Protecting a user
internet privacy from the world wide web. There are software products that will
mask or hide users IP address from the outside world to protect from identity
theft.
b) Hiding or deleting user
internet traces that are left on their PC after surfing the internet.
Computer Virus
It
is a computer program that can copy itself and infect a computer without the
permission or knowledge of the owner. It can damage, destroy data making the
system malfunction. When a system is infected by a virus, the following signs
and symptoms are observed:
a) Functions gets slower
than normal.
b) A system response slowly
and hangs on.
c) Restart itself
regularly.
d) Uncommon error messages,
menus and dialog box can be noticed.
e) Size of files may
increase.
Q)What viruses do?
→Can
damage files, can show messages, can slow system, can take control
Q) How Virus spreads?
→ A virus copies a copy of itself to another
important file. When these files opened or executed, it gets advantages and
starts showing its effects. Some virus appears as interesting program which
when clicked shows its effect. Some viruses may also spread through e-mail and
computer network.
Virus Protection
The
technique used to protect computer the folder and its data from viruses is
called
virus
protection. Way to protect computer from viruses are as follows:
a)
Use and update antiviruses software
b)
c)
Backup important files and ensure that they can
be restored
d)
Change the computer boot sequence to ‘always
start the PC from its hard–drive’
e)
Don’t use pirated disk
f)
Scan external storage device before using it
g)
Don’t access unknown websites and avoid
downloading files from unknown sources
Encryption & Decryption
Encryption: The
process of translating the plain text data (plain text) something that appears
to be random and meaningless (cipher text) is called encryption. The process of
converting data into a non-understandable format for its protection of is
called encryption.
|
Cipher Text
|
|
Plain Text
|
Decryption: It is
the process of converting the cipher text into back to the plain text. It helps
to extract the original data from the converted one.
|
Cipher Text
|
|
Plain Text
|
.
.
.
.
.
Public Key Encryption
The
type of encryption which has different keys for encryption and decryption. It
uses public key to encrypt data whereas a private key is used by a receiver to
decrypt data. In this method encryption and decryption algorithm are not the
inverse of each other.
RSA
It
is a public key encryption and the algorithm developed by Ron Rivest, Adi Shamir and Len Adelmen
in 1997. It is the most popular asymmetric key cryptography algorithm. It may
be used to provide both secrecy and digital signature. It uses prime number to
generate public and the private key based on mathematical fact and multiplying
large numbers together. It uses the block size data in which plain text and
cipher text are between zero and for some n values. The size of n is considered
1024 bits or 309 decimal digits. Here two different keys are used to encrypt
and decrypt. A sender knows the encryption key and the receiver knows the
decryption key.
Differences between DES and RSA
Features
|
DES
|
RSA
|
Key Used
|
Same Key
used for used for encryption and decryption.
|
Different
key used for used for encryption and decryption.
|
Scalability
|
It is
scalable due to varying the key size and block size
|
No
scalability occurs
|
Power Consumption
|
Low
|
High
|
Confidentiality
|
High
|
Low
|
Security
|
Not Secure enough
|
Least secure
|
Rounds
|
16
|
1
|
Authorization and Authentication
Authentication
a)
It is the process of verifying the identity of
user.
b)
It always proceeds to authorization.
c)
It has two separate levels because all the
request coming through the IIS before it is handled.
d)
They have additional schemes like windows
authentication, forms authentication and passport authentication.
Example: use of passwords, bio-metric identification system
etc.
Authorization
a)
It is the process of checking whether the user
has access rights to the systems.
b)
It is the process of allowing and authenticated
user to access the resources.
c)
It allows two ways to authorize the access to a
given resources.
d)
The two ways are URL authorization and file
authorization.
Example: Privilege given to an authenticate user to access
the resources like update/modify database or read only.
Firewalls
Firewalls
are software or hardware based security system that controls the traffic that
comes and goes on the network. They are essentially a barrier between trusted
networks and untrusted and less trusted network. Simply a firewall only permits
traffic from sources that are defined within the firewall. Firewall can be
either software or hardware based.
a)
Software
Based Firewall
It is a program installed in the computer that protect
computer from traffic from the computer. It is useful if a virus or other
threats make its way on to the networks. It can block them from infecting the
computer. It also allows the blocking of applications.
b)
Hardware
Based Firewall
It is a firewall located on the network router, standing as
a barrier between the internet and the entire network. It helps to protect the
network from hackers and other unwanted traffic coming to the network.
Digital
Signature
Digital
signature is a way to ensure that an electronic document (e-mail, spreadsheet,
text-file etc.) is authentic. Authentic means that you know created a document
and you know that it has not been altered in any way since that person created
it. Digital signature relies on certain type of encryption to ensure
authentication.
How
Digital Signature works?
Digital
Signature, like hand written signatures are unique to each signer. A digital
signature follows a specific protocol and uses mathematical algorithms to
generate two long numbers called keys. One key is public and one is private.
When
a signer electronically signs a document, the signature is created using
signer’s private key, which is kept securely by the signers. The mathematical
algorithm acts like a cipher, creating data matching the signed document called
a hash (#) and encrypting that data. The resulting encrypted data is the
digital signature. He signature is also marked with the time when it was
signed. If the document changes after signing, the digital signature is
invalidated.
Comments
Post a Comment