Documents
Resources
Learning Center
Upload
Plans & pricing Sign in
Sign Out

Download - Higher Colleges of Technology

VIEWS: 30 PAGES: 23

									              The Higher Colleges of Technology
                           AAMC




SECURITY ON THE INTERNET
   Prepared By: Faisal Al Marri & Abdulrahman Sayed


             Prepared For: Mr. Carl Haigh




                    07th June 2007
                                   The Higher Colleges of Technology
                                                AAMC




                                     Table of Contents

Introduction --------------------------------------------------------------------------------------3
1Background Research on Internet and Security ----------------------------------------3
  1.1The Differences between On-line and Off-line Businesses in Terms of Security
  and Access to Information --------------------------------------------------------------------3
  1.2The Importance of Maintaining Secure Systems --------------------------------------5
  1.3Real Life Example (Of On-line Threats) -----------------------------------------------6
2The Common Internet Standards and Protocols ----------------------------------------7
  2.1TCP/IP ---------------------------------------------------------------------------------------7
  2.2FTP -------------------------------------------------------------------------------------------7
  2.3HTTP ----------------------------------------------------------------------------------------7
  2.4Gopher ---------------------------------------------------------------------------------------8
  2.5DNS ------------------------------------------------------------------------------------------8
  2.6NETBIOS Protocol ------------------------------------------------------------------------8
3The Most Common Type of Hackers & Viruses ----------------------------------------9
  3.1Computer Hacker --------------------------------------------------------------------------9
  3.2Computer Virus ----------------------------------------------------------------------------9
4The Internet Protection and Relative Security Definitions ------------------------- 10
  4.1How Does the Internet Work ----------------------------------------------------------- 10
  4.2Physical Protection for Computers ---------------------------------------------------- 12
  4.3Physical & Software Access Control -------------------------------------------------- 13
  4.4Digital Security Tools for the E-Business -------------------------------------------- 14
Recommendations ----------------------------------------------------------------------------- 19
Resources ---------------------------------------------------------------------------------------- 20
Appendix ---------------------------------------------------------------------------------------- 21




                                                 2-23
                          The Higher Colleges of Technology
                                       AAMC




Introduction

Nowadays a trustable internet security is an important issue for any on-
line company. It secures their private information and secretes to avoid
tampering and to safeguard privacy rights. One of the basic truths behind
Internet security is that the Internet itself is not a secure environment.
Small businesses owners recognize the various threats involved in
conducting business over the Internet and establish security policies and
procedures to minimize their risks. This report will examine some relative
aspects to the issue with recommendations for securing the business on
the internet.




1Background Research on Internet and Security

1.1The Differences between On-line and Off-line Businesses in Terms of
Security and Access to Information


Initially, we know that On-line business means monitoring business
operations that are connected to the internet and Off-line means
implementing works without using the e-connection...
However, there are differences between them in security and
approaching to data...




                                        3-23
                                       The Higher Colleges of Technology
                                                    AAMC




             On-line Business                                              Off-line Business

   -   Easy to access to information from                      -    Not easy to catch information as it’s
       anywhere as the internet is open                             directly controlled by employees and
       environment.                                                 authorities.
   -   When a company is connected to the                      -    There is no risk of hackers or viruses and
       internet     and      exposed     to   external              warm attacks excluding being connected
       accessibility, it will be in risk of hackers,                or moving data by removable devices.
       or viruses and warm attacks.
   -   The        internal     business       network          -    It’s a Virtual Private Network, that
       recourses, is connected via the internet                     business is run internally and only the
       to give the availability of the business                     systems    connected    to   the     internal
       to have its information availed to                           network of the business can access the
       customers anywhere in the world.                             business information.
   -   In someway, information cannot be                       -    In someway, information can be viewed
       accessed by others unless they are                           by     potential   customers.      (Like   in
       registered     customers    or      employees.               governments departments).
       However the internet is open source
       for information.



Although both on-line and off-line businesses have risks in terms of
security and accessing to information, we believe that the risks in on-line
business are more massive because, generally, the internet it self is not
safe environment. In addition, all on-line businesses are linked to the
global net, and they are actually in an open electronic world where it is
hard to restrict many existing risks such as hacking, or Viruses and warm
attack, as business’s recourses are exposed to external accessibility.




                                                     4-23
                           The Higher Colleges of Technology
                                        AAMC




1.2The Importance of Maintaining Secure Systems
To any business security is always an important issue, as recourses and
information which are not provided to the public are considered to the
business very important, and being part of the company’s information
and business privacy, which could affect on the success or failure of that
business.
For example, KFC is a famous chain of fast food restaurants and as they
have a unique secret blend for their meals, this is the key of their success.
However, imagine if their secret blend was identified to a competitor by
someone breaching the security of information privacy... what will
happen? They would immediately loss their market and maybe the entire
business.
There are some features that results when business system is
compromised by hackers, worms or even script kiddies and will suffer
monetary loss due to these features as follows:
    Theft of intellectual property
   This is anything salable such as secret recipes, blue prints and patent
   information. These can be sale to competition.
    Theft of identity
   Credit card and social security numbers can be theft. For example,
   credit cards sell easily and quickly on the black market and social
   security numbers when sold to the appropriate parties are of much
   higher value.
    Saturated or disabled network resources
   Attackers are always interested in the resources available within
   business IT infrastructure. These unauthorized uses of resources will




                                         5-23
                                    The Higher Colleges of Technology
                                                 AAMC




      slow the efficiency and effectiveness of the business. The FTC's
      (Federal Trade Commission) identity theft survey released In
      September 2003 reported that there have been 27.3 million identity
      theft victims in the US.


In e-business, securing data is more important as the whole commercial
activities and transactions are conducted through the internet (an open
environment). The threat of viruses and hackers is always a concern for
on-line businesses as they can steal or destroy their data or information.
Here, the latest technologies continuously tend to provide security
solutions to e-businesses.




1.3Real Life Example (Of On-line Threats)
In November 2001, Three Northern Ireland government departments
have been hit by the (Nimda-E computer) virus.
The virus has closed down the computer systems in the Department of
the Environment, the Department for Regional Development and the
Department for Culture, Arts and Leisure.
The attack affected the issuing of planning decisions, Ministry of
Transportation vehicle test appointments, driving test dates and vehicle
tax discs. It is estimated that 5,000 computers in the departments will be
off-line until next week1.




1
    Read more: http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/1645630.stm


                                                  6-23
                          The Higher Colleges of Technology
                                       AAMC




According to Trend Micro Inc, in 2003 the total loses in global business
and enterprises sector due to computer and network viruses was (55
Billion Dollars).
We believe this loses affect negatively on other sectors and issues
especially the issue of global concerns like the growth in the third world
and poverty avoidance. That’s because these huge loses turn investors
and even governments toward acting seriously against viruses and
spending more money to design and enhance anti-virus technologies.




______________________________________________________________




2The Common Internet Standards and Protocols
2.1TCP/IP
It’s Transmission Control Protocol/Internet Protocol, this protocol is the
foundation of the Internet, an agreed upon set of rules directing
computers on how to exchange information with each other.


2.2FTP
(File Transfer Protocol) used to transfer files over a TCP/IP network.


2.3HTTP

(Hyper Text Transfer Protocol) A protocol used to request and transmit
files, especially webpage and webpage components, over the Internet or
other computer network.



                                        7-23
                          The Higher Colleges of Technology
                                       AAMC




2.4Gopher
It is a protocol for the storage and retrieval of text on a computer
network using a TCP/IP protocol.




2.5DNS
Directory Name Service is a TCP/IP based name resolution service. It is
used to resolve a host name to its associated IP address.




2.6NETBIOS Protocol
Standard for a NetBIOS service on a TCP/UDP transport, Network Basic
Input/Output System is a program that allows applications on different
computers to communicate within a local area network. It does not
support a routing mechanism, so applications communicating on a wide
area network must use another (transport mechanism) (such as TCP/IP)
rather than, or in addition, to NetBIOS.


_______________________________________________________________




                                        8-23
                            The Higher Colleges of Technology
                                         AAMC




3The Most Common Type of Hackers & Viruses
3.1Computer Hacker
Means Individuals or groups of computer programming experts who uses
their skills to gain illegal access to a computer network or file. The
following points show the common type of hackers...
   1. Theft of information: In a simple term means when your data and
       any information has been stolen.
   2. Theft of business secrets: It is specialized to steal any information
       about trading and selling.
   3. Software Theft: Also it is specialized to make copies pf programs.
   4. Denial of service: It is specialized to delete accounts and prevent
       users to use their accounts.
   5. Phishing Scum: It’s a criminal activity through the internet where
       (phishers) attempt to fraudulently obtain sensitive information,
       such as usernames, passwords and credit card details, by hiding
       behind a truthful entity in an electronic communication.


3.2Computer Virus

It is software used to infect a computer. After the virus code is written, it is
hidden within an existing program. Once that program is run, the virus code is
activated and attaches copies of itself to other programs in the system. Infected
programs copy the virus to other programs. The followed points set the
common type of viruses...

   1- A computer virus: attaches itself to a program or file so it can spread
       from one computer to another, leaving infections as it travels.




                                          9-23
                            The Higher Colleges of Technology
                                         AAMC




   2- A worm: is similar to a virus by its design, and is considered to be a sub-
      class of a virus. Worms spread from computer to computer, but unlike a
      virus, it has the capability to travel without any help from a person. A
      worm takes advantage of file or information transport features on your
      system, which allows it to travel unaided.
   3- The Trojan horse: like the real story it seems at first look to be useful
      software but will actually do damage once installed or run on your
      computer. Those on the receiving end of a Trojan horse are usually
      tricked into opening them because they appear to be receiving
      legitimate software or files from a legitimate source.




_______________________________________________________________




4The Internet Protection and Relative Security Definitions
4.1How Does the Internet Work
It is known that when we like to browse for any website we have to be
linked to the internet by networks. There are some devices that help us
browsing and securing our electronic process. Here are some of them...


Router
A router acts as a link between two or more networks to transfer data
packets among them. In simple words, it transfers data from our local
network to other network or to the public network (The internet). (See
figure1 in appendix).




                                         10-23
                          The Higher Colleges of Technology
                                       AAMC




Virtual Private Network
VPN is a private network that uses a public network like the internet to
connect remote sites or users together. It uses (virtual) connections
routed through the Internet from the company's private network to the
remote site. It has many facilities such as extending geographic
connectivity, improving security, reducing operational costs compared
with traditional WAN and reducing transit time and transportation costs
for remote users.


Firewall
Firewalls are mainly intended to protect the resources of a private
network from being directly accessed by a user from an external
network, especially via the Internet. Users inside the private network
may also be prevented from directly accessing external computers. To
accomplish this, all communications are routed through a (proxy server)
that determines whether a message or file will be allowed to enter or
exit the private network. (See figure 2 in appendix).
As the problem of IT department is to restrict a modern firewall system
that Safeguards Company’s information and customers privacy rights...
we would give some strengths and weaknesses of firewall in the
following table...




                                       11-23
                                The Higher Colleges of Technology
                                             AAMC




                  Strengths                                        Weaknesses
      Firewall can control which traffic is              Cannot protect against attacks not
       allowed to enter and exit your                      made through the firewall.
       network and actually you can also
       choose the degree of separation you                Cannot protect against all the viruses
       want is the key.                                    and new threats.

      Subdivide your internal network into               Policies involving of wrong use of
       various security zones.                             passwords and user accounts must be
                                                           strictly enforced and these problems
      Firewall can decrease the risk from                 must be planned in security policy
       certain types of attacks but cannot get             because firewall cannot solve it alone.
       rid of all of them.
                                                          Employee       bad    behavior    or
      Provide a single point into and out of              carelessness cannot be controlled by
       your network where your security                    firewalls.
       policies may be imposed.

      Firewall can provide a means of
       recording network activity, which is
       very important in case of any attacks
       firewall can be used to identify the
       source of the attack.




4.2Physical Protection for Computers
Nowadays, the issue of safeguarding our assets and equipment either in
homes or offices is very important due to the risk of being stolen by any
thefts (goods or Information or money).                       Thus a physical protection
system must always be considered in an office, so we should be able to
secure equipment and hardware existing in a work place. If servers or
desktop computers, that hold valuable information for the company,
were stolen we would lost these information forever or would take long
time to recover.
Some methods to protect our offices physically:




                                             12-23
                           The Higher Colleges of Technology
                                        AAMC




- Looking each device with a protection kit or a cable, that needs a
special key to replace.
- Making identified comical color prints, only visible with UV light and
unique to the client.




4.3Physical & Software Access Control
It is commonly known that access control points authenticate access login
to certain location or maybe the whole office, some examples of this is
protecting the gates and doors to offices with biometric readers, these
readers can vary but the most common are, the Finger biometric and eye
scan access points that you can see in high secure departments.
The physical part of the access points are devices that scans in and record
the biometric, these devices then connect to a database through a
controlled software with different parameters, that will authenticate the
data scanned either finger or eye, and with the records in the database, if
there was a match, then there it will allow that person to access,
otherwise if it was different it will not allow access to that person.
The development of biometric software affected the e-business
community, as they made accessing information on secure website more
protected and devices holding valuable information more protected.




                                        13-23
                          The Higher Colleges of Technology
                                       AAMC




4.4Digital Security Tools for the E-Business
Here, we will define briefly digital securing definitions and tools that
perfectly support and improve the security for on-line business
transactions...


Encryption
The coding of a clear text message by a transmitting unit so as to prevent
unauthorized spying along the transmission line, the receiving unit uses
the same algorithm as the transmitting unit to decode the incoming
message. Additionally, Decryption means to decode the encrypted
message.


Cryptography
Similarly to Encryption, it means the exchange of data into a secret code
for transmission over a public network. For example, the original text, or
(plaintext) is converted into a coded equivalent called (cipher text) via
an encryption algorithm. The cipher text is decoded (decrypted) at the
receiving end and turned back into plaintext.
There are two major structurally types for cryptography...
   1. Public Key Cryptography: An encryption method (language) that
      uses a two-part key: a public key and a secure key. To send an
      encrypted message to someone, you use the recipient's public key,
      which can be sent to you via regular e-mail or made available on
      any public Website. To decrypt the message, the recipient uses the
      secret key, which he keeps secret. Contrast with (secret key
      cryptography) which uses the same key to encrypt and decrypt.




                                       14-23
                          The Higher Colleges of Technology
                                       AAMC




   2. Secret Key Cryptography
      Typically refers to secret key cryptography, which uses the same
      secret key. However, the use of the term (secret) is confusing,
      because in public key cryptography, a (secret key) is used. (See
      figure3 in appendix).


Privacy:
The degree to which an individual can decide which personal
information is to be shared with whom and for what purpose. Although
always people pass confidential information to sellers by phone, mail or
fax, the Internet has brought this issue to the forefront. Thus, web sites
usually have privacy policies that instruct exactly what will be done with
the information you enter.


Information Security

It called to the process of protecting data from unauthorized access or
change for any reasons. Information security is concerned with the
confidentiality, integrity and availability of data regardless of the form
the data may take: electronic, print, or other forms. In addition, there
are three generally type of supervision on secured information;
administrative, technical and physical. Thus the access to this information
must be restricted to people who are authorized to access the
information. The computer programs must also be authorized.




                                       15-23
                           The Higher Colleges of Technology
                                        AAMC




Data Integrity
It’s the quality of correctness, completeness, wholeness, soundness and
compliance with the purpose of the creators of the data. It is achieved by
preventing unauthorized insertion, modification or destruction of data in
a database. It’s a part of the integral information security.


Authorization
The process of which either allows or refuses access to a network
resource. Most computer security systems are based on a two-step
process. The first step is authentication, which ensures that a user is who
claims to be. The second step is authorization, which allows the user
access to various resources based on the user's identity (the previous
stage).


Authentication
A process of which verifies the identity of a user logging into a network.
Passwords, digital certificates, smart cards and biometrics can be used to
prove the identity of the client to the network.


Non-repudiation
It means to ensure that a transferred message has been sent and received
by the same person who tend to be. Non-repudiation is a way to
guarantee that the sender of a message cannot later deny having sent the
message and that the recipient cannot deny having received the message.
Non-repudiation can be obtained through the use of Digital Signature.




                                        16-23
                             The Higher Colleges of Technology
                                          AAMC




Digital Certificate
It means the digital comparable of (IDCard) used in combination with a
public key encryption system. Also called (digital IDs). Digital certificates
are issued by a trusted third party known as a Certification Authority
(CA) such as VeriSign. Digital Certificates are based on public key
encryption, a scheme that uses public and private key pair. The private
key is known only by the owner and is used to create a digital signature.
This key must be kept private at all times by the user. The public key is
widely known and is used to confirm the digital signature. Definitely,
when you prove a digital signature, you want to know the identity of
the person who has signed the message.
Digital Certificates contain the owner’s public key, the owner’s name, an
expiration date, the name of the Certification Authority that issued the
Digital Certificate, and a serial number.


Digital Signature
A digital guarantee that information has not been modified. The two
major applications of digital signatures are for setting up a secure
connection to a Website and verifying the integrity of files transmitted.




SSL (Secure Sockets Layer)
The leading security protocol on the Internet. SSL is widely used to do
two jobs: to validate the identity of a Website and to create an
encrypted connection for sending credit card and other personal data.
For example, look for a lock icon at the bottom of your browser when




                                          17-23
                         The Higher Colleges of Technology
                                      AAMC




you order purchasing on the Web. If the lock is closed, you are on a
secure SSL connection.


Payment Getaway
Payment Gateway is an e-commerce ASP service that authorizes
payments for e-businesses and on-line retailers. It encrypts sensitive
information, such as credit card numbers, to ensure that information
passes securely between the customer and the seller.
In addition, it facilitates the transfer of information between a payment
portal (such as a website) and the Front-End Processor or acquiring bank
quickly and securely. Thus when a customer orders a product from a
Payment Gateway enabled seller, the payment gateway performs a
variety of tasks to process the transaction completely invisible to the
customer.




PGP
(Pretty Good Privacy) is a data encryption program published as
freeware (free or open source) in 1991 and widely used around the
world for encrypting e-mail messages and securing files. For e-mail, PGP
sends the key and the encrypted message at the same time. It encrypts
the key using a public key algorithm and encrypts the message using a
secret key algorithm.




                                      18-23
                        The Higher Colleges of Technology
                                     AAMC




Recommendations

   We recommend for the company to use modern firewalls because
    firewalls are known to maintain a high profile security on any
    network available. So we found that it is better for the company
    to use different or more than one firewall program to protect its
    network and increase their security level.
   Also we recommend the use of Digital Certificates and digital
    signatures, as there are well-known and trustable companies that
    provide this service perfectly and with proper prices such as
    VerSign and GlobalSign. This will certainly secure all transactions
    and e-letters between the company and its customers.




                                     19-23
                           The Higher Colleges of Technology
                                        AAMC




                                   Resources

www.answers.com

www.google.com

http://www.garykessler.net/library/web_security.html

http://www.trendmicro.com/

http://www.webopedia.com/DidYouKnow/Internet/2004/virus.asp

http://computer.howstuffworks.com/

http://www.vikont.com/clients/glossary.htm

http://www.greencomputer.com/solutions/glossary.shtml

http://en.wikipedia.org/wiki/Phishing

http://www.garykessler.net/library/web_security.html

http://www.adobe.com/devnet/logged_in/vviehe_security.htm

www.articleblotter.com/Article/Difference-between-online-and-offline-

stock-trading

http://www.tamingthebeast.net/tools/security-software.htm

http://www.rfgonline.com/subsforum/archive/daily/031300/031500nt.ht

ml

http://en.wikipedia.org/wiki/Information_security

http://www.netragard.com/html/services/importance.html

http://www.loma.org/res-05-04-cyber-risk.asp



                                        20-23
The Higher Colleges of Technology
             AAMC




        Appendix

          Figure1




             21-23
 The Higher Colleges of Technology
              AAMC




           Figure2




                  Internet




Pu blic
                  Firewall
 Web
Se rve r




                    Internal
                    Ne twork




              22-23
The Higher Colleges of Technology
             AAMC




          Figure3




             23-23

								
To top