Internet security

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
This article is part of a series on
Information security
Related security categories
Threats
Defenses

Internet security is a branch of computer security specifically related to not only Internet, often involving browser security and the World Wide Web[citation needed], but also network security as it applies to other applications or operating systems as a whole. Its objective is to establish rules and measures to use against attacks over the Internet.[1] The Internet represents an insecure channel for exchanging information, which leads to a high risk of intrusion or fraud, such as phishing,[2] online viruses, trojans, worms and more.

Many methods are used to protect the transfer of data, including encryption and from-the-ground-up engineering. The current focus is on prevention as much as on real time protection against well known and new threats.

Threats[edit]

Malicious software[edit]

An internet user can be tricked or forced into downloading software that is of malicious intent onto a computer. Such software comes in many forms, such as viruses, Trojan horses, spyware, and worms.

  • Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. Malware is defined by its malicious intent, acting against the requirements of the computer user, and does not include software that causes unintentional harm due to some deficiency. The term badware is sometimes used, and applied to both true (malicious) malware and unintentionally harmful software.
  • A botnet is a network of zombie computers that have been taken over by a robot or bot that performs large-scale malicious acts for the creator of the botnet.
  • Computer Viruses are programs that can replicate their structures or effects by infecting other files or structures on a computer. The common use of a virus is to take over a computer to steal data.
  • Computer worms are programs that can replicate themselves throughout a computer network, performing malicious tasks throughout.
  • Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in order for the restriction to be removed.
  • Scareware is scam software of usually limited or no benefit, containing malicious payloads, that is sold to consumers via certain unethical marketing practices. The selling approach uses social engineering to cause shock, anxiety, or the perception of a threat, generally directed at an unsuspecting user.
  • Spyware refers to programs that surreptitiously monitor activity on a computer system and report that information to others without the user's consent.
  • One particular kind of spyware is key logging malware. Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard.
  • A Trojan horse, commonly known as a Trojan, is a general term for malicious software that pretends to be harmless, so that a user will be convinced to download it onto the computer.

Denial-of-service attacks[edit]

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users. Another way of understanding DDoS is seeing it as attacks in cloud computing environment that are growing due to the essential characteristics of cloud computing.[3] Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. According to businesses who participated in an international business security survey, 25% of respondents experienced a DoS attack in 2007 and 16.8% experienced one in 2010.[4] DoS attacks often use bots (or a botnet) to carry out the attack.

Phishing[edit]

Main article: Phishing

Phishing is an attack which targets online users for extraction of their sensitive information such as username, password and credit card information.[5] Phishing occurs when the attacker pretends to be a trustworthy entity, either via email or web page. Victims are directed to fake web pages, which are dressed to look legitimate, via spoof emails, instant messenger/social media or other avenues. Often tactics such as email spoofing are used to make emails appear to be from legitimate senders, or long complex subdomains hide the real website host.[6][7] Insurance group RSA said that phishing accounted for worldwide losses of $10.8 billion in 2016.[8]

Application vulnerabilities[edit]

Main article: Application security

Applications used to access Internet resources may contain security vulnerabilities such as memory safety bugs or flawed authentication checks. The most severe of these bugs can give network attackers full control over the computer. Most security applications and suites are incapable of adequate defense against these kinds of attacks.[9][10]

A very and widespread web-browser application vulnerability is the so-called Cross-Origin Resource Sharing (CORS) vulnerability- for maximum security and privacy, make sure to adopt adequate countermeasures against it (such as the example patches provided for WebKit-based browsers).

Countermeasures[edit]

Network layer security[edit]

TCP/IP protocols may be secured with cryptographic methods and security protocols. These protocols include Secure Sockets Layer (SSL), succeeded by Transport Layer Security (TLS) for web traffic, Pretty Good Privacy (PGP) for email, and IPsec for the network layer security.

Internet Protocol Security (IPsec)[edit]

IPsec is designed to protect TCP/IP communication in a secure manner. It is a set of security extensions developed by the Internet Task Force (IETF). It provides security and authentication at the IP layer by transforming data using encryption. Two main types of transformation that form the basis of IPsec: the Authentication Header (AH) and ESP. These two protocols provide data integrity, data origin authentication, and anti-replay service. These protocols can be used alone or in combination to provide the desired set of security services for the Internet Protocol (IP) layer.

The basic components of the IPsec security architecture are described in terms of the following functionalities:

  • Security protocols for AH and ESP
  • Security association for policy management and traffic processing
  • Manual and automatic key management for the Internet key exchange (IKE)
  • Algorithms for authentication and encryption

The set of security services provided at the IP layer includes access control, data origin integrity, protection against replays, and confidentiality. The algorithm allows these sets to work independently without affecting other parts of the implementation. The IPsec implementation is operated in a host or security gateway environment giving protection to IP traffic.

Multi-factor authentication[edit]

Multi-factor authentication (MFA) is a method of computer access control in which a user is granted access only after successfully presenting several separate pieces of evidence to an authentication mechanism – typically at least two of the following categories: knowledge (something they know), possession (something they have), and inherence (something they are).[11][12] Internet resources, such as websites and email, may be secured using multi-factor authentication.

Security token[edit]

Some online sites offer customers the ability to use a six-digit code which randomly changes every 30–60 seconds on a security token. The keys on the security token have built in mathematical computations and manipulate numbers based on the current time built into the device. This means that every thirty seconds there is only a certain array of numbers possible which would be correct to validate access to the online account. The website that the user is logging into would be made aware of that device's serial number and would know the computation and correct time built into the device to verify that the number given is indeed one of the handful of six-digit numbers that works in that given 30-60 second cycle. After 30–60 seconds the device will present a new random six-digit number which can log into the website.[13]

Electronic mail security[edit]

Background[edit]

Email messages are composed, delivered, and stored in a multiple step process, which starts with the message's composition. When the user finishes composing the message and sends it, the message is transformed into a standard format: an RFC 2822 formatted message. Afterwards, the message can be transmitted. Using a network connection, the mail client, referred to as a mail user agent (MUA), connects to a mail transfer agent (MTA) operating on the mail server. The mail client then provides the sender’s identity to the server. Next, using the mail server commands, the client sends the recipient list to the mail server. The client then supplies the message. Once the mail server receives and processes the message, several events occur: recipient server identification, connection establishment, and message transmission. Using Domain Name System (DNS) services, the sender’s mail server determines the mail server(s) for the recipient(s). Then, the server opens up a connection(s) to the recipient mail server(s) and sends the message employing a process similar to that used by the originating client, delivering the message to the recipient(s).

Pretty Good Privacy (PGP)[edit]

Pretty Good Privacy provides confidentiality by encrypting messages to be transmitted or data files to be stored using an encryption algorithm such as Triple DES or CAST-128. Email messages can be protected by using cryptography in various ways, such as the following:

  • Signing an email message to ensure its integrity and confirm the identity of its sender.
  • Encrypting the body of an email message to ensure its confidentiality.
  • Encrypting the communications between mail servers to protect the confidentiality of both message body and message header.

The first two methods, message signing and message body encryption, are often used together; however, encrypting the transmissions between mail servers is typically used only when two organizations want to protect emails regularly sent between each other. For example, the organizations could establish a virtual private network (VPN) to encrypt the communications between their mail servers over the Internet.[14] Unlike methods that can only encrypt a message body, a VPN can encrypt entire messages, including email header information such as senders, recipients, and subjects. In some cases, organizations may need to protect header information. However, a VPN solution alone cannot provide a message signing mechanism, nor can it provide protection for email messages along the entire route from sender to recipient.

Multipurpose Internet Mail Extensions (MIME)[edit]

MIME transforms non-ASCII data at the sender's site to Network Virtual Terminal (NVT) ASCII data and delivers it to client's Simple Mail Transfer Protocol (SMTP) to be sent through the Internet.[15] The server SMTP at the receiver's side receives the NVT ASCII data and delivers it to MIME to be transformed back to the original non-ASCII data.

Message Authentication Code[edit]

A Message authentication code (MAC) is a cryptography method that uses a secret key to digitally sign a message. This method outputs a MAC value that can be decrypted by the receiver, using the same secret key used by the sender. The Message Authentication Code protects both a message's data integrity as well as its authenticity.[16]

Firewalls[edit]

A computer firewall controls access between networks. It generally consists of gateways and filters which vary from one firewall to another. Firewalls also screen network traffic and are able to block traffic that is dangerous. Firewalls act as the intermediate server between SMTP and Hypertext Transfer Protocol (HTTP) connections.

Role of firewalls in web security[edit]

Firewalls impose restrictions on incoming and outgoing Network packets to and from private networks. Incoming or outgoing traffic must pass through the firewall; only authorized traffic is allowed to pass through it. Firewalls create checkpoints between an internal private network and the public Internet, also known as choke points (borrowed from the identical military term of a combat limiting geographical feature). Firewalls can create choke points based on IP source and TCP port number. They can also serve as the platform for IPsec. Using tunnel mode capability, firewall can be used to implement VPNs. Firewalls can also limit network exposure by hiding the internal network system and information from the public Internet.

Types of firewall[edit]

Packet filter[edit]

A packet filter is a first generation firewall that processes network traffic on a packet-by-packet basis. Its main job is to filter traffic from a remote IP host, so a router is needed to connect the internal network to the Internet. The router is known as a screening router, which screens packets leaving and entering the network.

Stateful packet inspection[edit]

In a stateful firewall the circuit-level gateway is a proxy server that operates at the network level of an Open Systems Interconnection (OSI) model and statically defines what traffic will be allowed. Circuit proxies will forward Network packets (formatted unit of data ) containing a given port number, if the port is permitted by the algorithm. The main advantage of a proxy server is its ability to provide Network Address Translation (NAT), which can hide the user's IP address from the Internet, effectively protecting all internal information from the Internet.

Application-level gateway[edit]

An application-level firewall is a third generation firewall where a proxy server operates at the very top of the OSI model, the IP suite application level. A network packet is forwarded only if a connection is established using a known protocol. Application-level gateways are notable for analyzing entire messages rather than individual packets of data when the data are being sent or received.

Browser choice[edit]

Main article: Browser security

Web browser statistics tend to affect the amount a Web browser is exploited. For example, Internet Explorer 6, which used to own a majority of the Web browser market share,[17] is considered extremely insecure[18] because vulnerabilities were exploited due to its former popularity.

Internet security products[edit]

Antivirus[edit]

Antivirus software and Internet security programs can protect a programmable device from attack by detecting and eliminating malware; Antivirus software was mainly shareware in the early years of the Internet,[when?] but there are now[when?] several free security applications on the Internet to choose from for all platforms.[19]

Password managers[edit]

A password manager is a software application that helps a user store and organize passwords. Password managers usually store passwords encrypted, requiring the user to create a master password; a single, ideally very strong password which grants the user access to their entire password database from top to bottom.[20]

Security suites[edit]

So called security suites were first offered for sale in 2003 (McAfee) and contain a suite of firewalls, anti-virus, anti-spyware and more.[21] They also offer theft protection, portable storage device safety check, private Internet browsing, cloud anti-spam, a file shredder or make security-related decisions (answering popup windows) and several were free of charge.[22]

History[edit]

In 1972, Egyptian engineer Mohamed M. Atalla filed U.S. Patent 3,938,091 for a remote PIN verification system, which utilized encryption techniques to assure telephone link security while entering personal ID information, which would be transmitted as encrypted data over telecommunications networks to a remote location for verification. This was a precursor to Internet security and e-commerce.[23]

At the National Association of Mutual Savings Banks (NAMSB) conference in January 1976, Atalla Corporation (founded by Mohamed Atalla) and Bunker Ramo Corporation (founded by George Bunker and Simon Ramo) introduced the earliest products designed for dealing with online security. Atalla announced an upgrade to its Identikey hardware security module, called the Interchange Identikey. It added the capabilities of processing online transactions and dealing with network security. Designed with the focus of taking bank transactions online, the Identikey system was extended to shared-facility operations. It was consistent and compatible with various switching networks, and was capable of resetting itself electronically to any one of 64,000 irreversible nonlinear algorithms as directed by card data information. The Interchange Identikey device was released in March 1976.[24] In 1979, Atalla introduced the first network security processor (NSP).[25]

See also[edit]

References[edit]

  1. ^ Gralla, Preston (2007). How the Internet Works. Indianapolis: Que Pub. ISBN 978-0-7897-2132-7.
  2. ^ Rhee, M. Y. (2003). Internet Security: Cryptographic Principles, Algorithms and Protocols. Chichester: Wiley. ISBN 0-470-85285-2.
  3. ^ Yan, Q.; Yu, F. R.; Gong, Q.; Li, J. (2016). "Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges". IEEE Communications Surveys and Tutorials. 18 (1): 602–622. doi:10.1109/COMST.2015.2487361.
  4. ^ "Information Sy-infographic". University of Alabama at Birmingham Business Program. Missing or empty |url= (help)
  5. ^ Izak, Belarua. "Welke virusscanners zijn het beste voor macOS High Sierra". Virusscanner MAC (in Dutch). Retrieved 4 January 2018.
  6. ^ Ramzan, Zulfikar (2010). "Phishing attacks and countermeasures". In Stamp, Mark & Stavroulakis, Peter (eds.). Handbook of Information and Communication Security. Springer. ISBN 9783642041174.CS1 maint: uses authors parameter (link) CS1 maint: uses editors parameter (link)
  7. ^ van der Merwe, Alta; Loock, Marianne; Dabrowski, Marek (2005). "Characteristics and Responsibilities Involved in a Phishing Attack". Proceedings of the 4th International Symposium on Information and Communication Technologies. Trinity College Dublin: 249–254. Retrieved 4 January 2018.
  8. ^ Long, Mathew (February 22, 2017). "Fraud Insights Through Integration". RSA. Retrieved October 20, 2018.
  9. ^ "Improving Web Application Security: Threats and Countermeasures". msdn.microsoft.com. Retrieved 2016-04-05.
  10. ^ "Justice Department charges Russian spies and criminal hackers in Yahoo intrusion". Washington Post. Retrieved 15 March 2017.
  11. ^ "Two-factor authentication: What you need to know (FAQ) – CNET". CNET. Retrieved 2015-10-31.
  12. ^ "How to extract data from an iCloud account with two-factor authentication activated". iphonebackupextractor.com. Retrieved 2016-06-08.
  13. ^ Margaret Rouse (September 2005). "What is a security token?". SearchSecurity.com. Retrieved 2014-02-14.
  14. ^ "Virtual Private Network". NASA. Archived from the original on 2013-06-03. Retrieved 2014-02-14.
  15. ^ Asgaut Eng (1996-04-10). "Network Virtual Terminal". The Norwegian Institute of Technology ppv.org. Retrieved 2014-02-14.
  16. ^ "What Is a Message Authentication Code?". Wisegeek.com. Retrieved 2013-04-20.
  17. ^ "Browser Statistics". W3Schools.com. Retrieved 2011-08-10.
  18. ^ Bradly, Tony. "It's Time to Finally Drop Internet Explorer 6". PCWorld.com. Retrieved 2010-11-09.
  19. ^ Larkin, Eric (2008-08-26). "Build Your Own Free Security Suite". Retrieved 2010-11-09.
  20. ^ "USE A FREE PASSWORD MANAGER" (PDF). scsccbkk.org. Archived from the original (PDF) on 2016-01-25. Retrieved 2016-06-17.
  21. ^ Rebbapragada, Narasu. "All-in-one Security". PC World.com. Archived from the original on October 27, 2010. Retrieved 2010-11-09.
  22. ^ "Free products for PC security". 2015-10-08.
  23. ^ "The Economic Impacts of NIST's Data Encryption Standard (DES) Program" (PDF). National Institute of Standards and Technology. United States Department of Commerce. October 2001. Retrieved 21 August 2019.
  24. ^ "Four Products for On-Line Transactions Unveiled". Computerworld. IDG Enterprise. 10 (4): 3. 26 January 1976.
  25. ^ Burkey, Darren (May 2018). "Data Security Overview" (PDF). Micro Focus. Retrieved 21 August 2019.

External links[edit]

Retrieved from "https://en.wikipedia.org/w/index.php?title=Internet_security&oldid=941977440"