1. XP New Perspectives on the Internet, 4e Tutorial 9 1 Securing and Enhancing Your Use of the Internet Internet Security and Browser Extensions

2. XP New Perspectives on the Internet, 4e Tutorial 9 2 Objectives Investigate the different kinds of computer threats. Identify countermeasures for protecting yourself and your computer while using the Internet. Learn about copyright and intellectual property rights on the Internet.

3. XP New Perspectives on the Internet, 4e Tutorial 9 3 Objectives Learn how to enhance your Web browser with browser extensions. Use popular plug-ins to view animated Web site content. Locate and use browser extensions.

4. XP New Perspectives on the Internet, 4e Tutorial 9 4 Security Overview Security is broadly defined as the protection of assets from unauthorized access, use, alteration, or destruction. Physical security includes tangible protection devices, such as locks, alarms, fireproof doors, security fences, safes or vaults, and bombproof buildings. Protection of assets using non-physical means is called logical security.

5. XP New Perspectives on the Internet, 4e Tutorial 9 5 Security Overview Logical security may also be broadly called computer security. Any act or object that endangers an asset is known as a threat. Countermeasure is the general name for a procedure, either physical or logical, that recognizes, reduces, or eliminates a threat. Countermeasures can recognize and manage threats or they can eliminate them.

6. XP New Perspectives on the Internet, 4e Tutorial 9 6 Risk Management Model Low Probability High Probability High Impact (cost) Low Impact (cost) Contain and control Prevent Ignore Insurance or backup plan

7. XP New Perspectives on the Internet, 4e Tutorial 9 7 Security Overview To implement a good security scheme, you identify the risk, determine how you will protect the affected asset, and calculate the cost of the resources you can allocate to protect the asset. Computer security can be classified into several categories:  Secrecy  Integrity  Necessity

8. XP New Perspectives on the Internet, 4e Tutorial 9 8 Security Overview Secrecy prevents unauthorized data disclosure and ensures the authenticity of the data’s source. Integrity prevents unauthorized data modification. Necessity prevents data delays (slowing down the transmission of data) or denials (preventing data from getting to its destinations. Internet users and businesses with Web sites need to take appropriate countermeasures in each of these three categories to protect themselves and the computers they use to connect to the Internet.

9. XP New Perspectives on the Internet, 4e Tutorial 9 9 Encryption Encryption is the process of coding information using a mathematical-based program and a secret key to produce a string of characters that is unreadable. The process of reversing encrypted text is called decryption. In order to decrypt text, you need a key to “unlock” it. Encrypted information is called cipher text. Unencrypted information is called plain text. The process of transforming data from a readable format (plain text) to an unreadable format (cipher text) is called cryptography.

10. XP New Perspectives on the Internet, 4e Tutorial 9 10 Encryption Private-key encryption (symmetric encryption) uses a single key that is known by the sender and receiver. The key might be a password or a number generated by a special device. Private-key encryption works well in a highly controlled environment.

11. XP New Perspectives on the Internet, 4e Tutorial 9 11 Private-key (Symmetric) Encryption encryptdecrypt common key

12. XP New Perspectives on the Internet, 4e Tutorial 9 12 Encryption Public-key encryption (asymmetric encryption) uses two different keys—a public key and a private or secret key. The public key is known to everyone. The private or secret key is known only to the person who owns both keys. With public-key encryption, each person has a private key that is secret and a public key that is shared with other users. Messages encrypted with a private key must be decrypted with the public key, and vice versa.

13. XP New Perspectives on the Internet, 4e Tutorial 9 13 Public-key (asymmetric) Encryption encrypt public keyprivate key decrypt

14. XP New Perspectives on the Internet, 4e Tutorial 9 14 Encryption Encryption is considered to be weak or strong based on its algorithm and the number of characters in the encryption key. An algorithm is a formula or set of steps to solve a particular problem. A cracker is a person who uses his knowledge of computers and programming to gain unauthorized access to a computer for the purpose of stealing or altering data. Keys that are 128 bits long are called strong keys.

15. XP New Perspectives on the Internet, 4e Tutorial 9 15 Using Certificates for Authentication and Identification Authentication is a general term for the process of correctly verifying the identify of a person or a Web site. The primary countermeasure for authentication is a digital certificate. A digital certificate is an encrypted and password-protected file that contains sufficient information to authenticate and prove a person’s or organization’s identity. A digital certificate is an electronic equivalent of an identification card.

16. XP New Perspectives on the Internet, 4e Tutorial 9 16 Using Certificates for Authentication and Identification A certificate authority (CA) is a trusted third party which verifies the certificate holder’s identity and issues the digital certificate. A digital ID (personal certificate) is used to identify a person to other people and to Web sites that are set up to accept digital certificates. A digital ID is an electronic file that you purchase from a certificate authority and install into a program that uses it, such as an e-mail program or a Web browser.

17. XP New Perspectives on the Internet, 4e Tutorial 9 17 Using Certificates for Authentication and Identification The digital ID authenticates the user and protects data being transferred online from being altered or stolen. A server certificate (SSL Web server certificate) authenticates a Web site for its users so the user can be confident that the Web site is genuine and not an imposter. A server certificate also ensures that the transfer of data between a user’s computer and the server with the certificate is encrypted so that it is both tamperproof and free from being intercepted.

18. XP New Perspectives on the Internet, 4e Tutorial 9 18 Processing a Certificate client 1 client 2 server I would like to order part #4988. Here’s our server certificate. This transaction is secure. Here’s my digital ID. What’s my account balance? Your digital ID is valid. Your balance is $345.00.

19. XP New Perspectives on the Internet, 4e Tutorial 9 19 Using Certificates for Authentication and Identification User identification is the process of identifying yourself to a computer. Most computer systems implement user identification with user names and passwords; the combination of a user name and password is sometimes called a login. To help keep track of their login information for different computers and Web sites, some people use a program called a password manager, which stores login information in an encrypted form on their computer.

20. XP New Perspectives on the Internet, 4e Tutorial 9 20 Using Certificates for Authentication and Identification Crackers can run programs that create and enter passwords from a dictionary or a list of commonly used passwords. A brute force attack occurs when a cracker uses a program to enter character combinations until the system accepts a user name and password, thereby gaining access to the system. User authentication is the process of associating a person and his identification with a very high level of assurance.

21. XP New Perspectives on the Internet, 4e Tutorial 9 21 Secure Sockets Layer (SSL) Secure Sockets Layer (SSL) is a widely used protocol that acts as a separate layer or “secure channel” on top of the TCP/IP Internet protocol. SSL provides a security handshake when a browser and the Web page to which it is connected want to participate in a secure connection. Web pages secured by SSL have URLs that begin with https:// instead of http://.

22. XP New Perspectives on the Internet, 4e Tutorial 9 22 Secure State Indicator closed padlock on the status bar indicates a secure state Internet Explorer Navigator

23. XP New Perspectives on the Internet, 4e Tutorial 9 23 Secure Sockets Layer (SSL) SSL creates a public-key pair so that it can safely transmit data using a private key. The private key is encrypted using public-key encryption and is sent to the browser. Using the private key protects the remainder of the information transfer between the browser and the Web site. When the user leaves the secure Web site, the browser discards these temporary keys, or session keys. Session keys exist only during a single, active session between a browser and server.

24. XP New Perspectives on the Internet, 4e Tutorial 9 24 Managing Cookies A cookie is a small text file that a Web server creates and stores on your computer’s hard drive. A cookie might store data about the links you click while visiting the Web site (called a click stream), information about the products you purchase, or personal information that you provide to the site. Some cookies are removed automatically when you leave a Web site (a session-only cookie).

25. XP New Perspectives on the Internet, 4e Tutorial 9 25 Managing Cookies Many Web sites use cookies to make their sites easier to navigate. A cookie is not a program and it can only store information that you provide to the Web site that creates it. Sometimes you provide the data openly, and at other times, the cookie might silently record your behavior at a Web site. Only the Web site that stored the cookie on your hard drive can read it, and it cannot read other cookies on your hard drive or any other file on your computer.

26. XP New Perspectives on the Internet, 4e Tutorial 9 26 Managing Cookies Cookies can represent a security threat for some users, especially those who access the site from a public computer. Internet users can control the storage of cookies on their computer’s hard drive by changing their browser’s settings. The best way to prevent another user from gaining access to information is to make sure that you do not leave an electronic trail to its path. Internet Explorer stores cookies in C:\Windows\Cookies folder. Navigator stores cookies in a file named cookies.txt on the user’s hard drive.

27. XP New Perspectives on the Internet, 4e Tutorial 9 27 Managing Cookies in Internet Explorer click to change cookie settings click to delete all cookie files

28. XP New Perspectives on the Internet, 4e Tutorial 9 28 Managing Cookies in Navigator options for enabling and disabling cookies click to change cookie settings and to delete cookies

29. XP New Perspectives on the Internet, 4e Tutorial 9 29 Web Bugs, Spyware, and Adware A Web bug is a small, hidden graphic on a Web page or in an e-mail message that is designed to work in conjunction with a cookie to obtain information about the person viewing the page or e-mail message and to send the information to a third party. When the user loads the Web page that contains this code, the browser downloads the hidden graphic. This process can identify your IP address, the Web site you last visited, and other information about your use of the site in which the clear GIF file has been embedded and record it in the cookie file.

30. XP New Perspectives on the Internet, 4e Tutorial 9 30 HTML for a Web Bug var axel = Math.random( )+” “; document.write(‘ ’);

31. XP New Perspectives on the Internet, 4e Tutorial 9 31 Web Bugs, Spyware, and Adware Adware is a general category of software that includes advertisements to help pay for the product in which they appear. In many freeware and shareware programs, adware provides opportunities for developers to offer software at little or no cost to the user. Adware usually does not cause any security threats because the user is aware of the ads and the parties responsible for including them are clearly identified in the programs.

32. XP New Perspectives on the Internet, 4e Tutorial 9 32 Web Bugs, Spyware, and Adware Spyware is a category of adware in which the user has little control over or knowledge of the ads and other monitoring features it contains. Spyware occurs in situations where a developer has sold ads to a third party or embedded other features in the program. A Web bug is an example of spyware because the clear GIF and its actions are hidden from the user.

33. XP New Perspectives on the Internet, 4e Tutorial 9 33 Web Bugs, Spyware, and Adware One way to protect computers from the potential privacy violations created by cookies, Web bugs, and spyware is to set Web browsers to block third-party cookie files. There are many good shareware programs that erase spyware from your computer. These programs, sometimes called ad blockers, search for files written by known spyware.

34. XP New Perspectives on the Internet, 4e Tutorial 9 34 Firewalls The computer version of a firewall is a software program or hardware device that controls access between two networks, such as a local area network and the Internet or the Internet and a computer. A port on a computer is like a door; it permits traffic to leave and enter a computer. When the port is closed, traffic can’t leave or enter the computer. A port scan occurs when one computer tests all or some of the ports of another computer to determine whether its ports are open, closed, or stealth.

35. XP New Perspectives on the Internet, 4e Tutorial 9 35 Basic Firewall Architecture Traffic from an unknown source arrives at the firewall. The firewall does not recognize the computer and either blocks it entirely or displays an alert so the user can accept or block the request. Traffic from a known source arrives at the firewall. Because the firewall knows the computer that sends the request, it lets the request through to the client. Request goes through the firewall and arrives at the client. client firewall Internet

36. XP New Perspectives on the Internet, 4e Tutorial 9 36 Firewalls Until the recent increase in the number of users with broadband connections to the Internet, corporations used hardware firewalls almost exclusively. Some firewall software programs are available for free or at a very low cost so they are become popular with other types of users. Some antivirus programs and Internet suites include basic firewall protection.

37. XP New Perspectives on the Internet, 4e Tutorial 9 37 Integrity Threats and Countermeasures An integrity threat occurs when an unauthorized party has the chance to alter data while it is being transferred over the Internet or while it is stored on a computer. The most visible integrity threats have been from Trojan horses, viruses, and worms that attack computers and the programs they run. A Trojan horse is a small program hidden inside another program that causes harm when the user accesses or downloads the program in which it is hidden.

38. XP New Perspectives on the Internet, 4e Tutorial 9 38 Protecting E-Mail Messages To help maintain the integrity of an e-mail message, you can send the message through a message digest function program (hash code function program) to produce a number called a message authentication code (MAC). After it receives the MAC, the e-mail program sends the message and matching MAC together to the recipient. The recipient’s e-mail program recomputes the message’s MAC and compares the computed MAC to the received MAC. If they match, the content of the message is unaltered. If they do not match, then the message cannot be trusted.

39. XP New Perspectives on the Internet, 4e Tutorial 9 39 Producing a MAC for a Message preserve this message AC2345HJ

40. XP New Perspectives on the Internet, 4e Tutorial 9 40 Protecting E-Mail Messages To be useful, the message digest function must exhibit the following characteristics:  It must be impossible or costly to reverse the MAC and produce the original message.  The MAC should be random  The MAC must be unique to the message You can also protect outgoing e-mail messages with the Secure/Multipurpose Internet Mail Extensions (S/MIME) specification, which when combined with a person’s digital ID provides authentication and encryption to e-mail messages.

41. XP New Perspectives on the Internet, 4e Tutorial 9 41 Necessity Threats and Countermeasure Necessity occurs when a cracker uses a program to disrupt normal computer processing or, possibly, to deny processing entirely. A packet flooding attack occurs when a cracker bombards a server or other computer with messages in an attempt to consume the network’s bandwidth resources. Delaying processing can also render a service unusable or unattractive.

42. XP New Perspectives on the Internet, 4e Tutorial 9 42 Necessity Threats and Countermeasure One of the most dangerous entry points for delay and denial threats come from coded programs that travel with applications to a browser and execute on the user’s computer. A Java applet, which is a program written in the Java programming language, could execute and consume a computer’s resources. A JavaScript program can pose a problem because its programs can run without being compiled before running on a computer. ActiveX components are Microsoft’s technology for writing small applications that perform some action in Web pages—these components have full access to a computer’s file system.

43. XP New Perspectives on the Internet, 4e Tutorial 9 43 Copyright & Intellectual Property Threats and Countermeasures Copyright is the protection of expression—someone’s or some entity’s intellectual property. Intellectual property is the ownership of ideas and control over the tangible or virtual representation of those ideas. The U.S. Copyright Act of 1976 and the 1998 Sonny Bono Copyright Term Extension Act protect copyrighted items for a fixed period.

44. XP New Perspectives on the Internet, 4e Tutorial 9 44 Copyright & Intellectual Property Threats and Countermeasures Unless you have received permission to reproduce the item protected by copyright, you are violating the work’s copyright if you illegally reproduce an item in any form before its copyright expires. A digital watermark is a process that inserts a digital pattern containing copyright information into a digital image, animation, or audio or video file. Steganography is a process that hides an encrypted message within different types of files. It can be used to add copyright information to different types of files.

45. XP New Perspectives on the Internet, 4e Tutorial 9 45 Enhancing Your Use of the Internet with Browser Extensions Browser extensions allow a Web browser to perform tasks it was not originally designed to perform. Plug-in: integrated browser software that the browser uses to display or play a specific file that you request. Helper applications: programs installed on the user’s computer that the browser starts and uses to “help” display or play a file. Add-ons: include tools that enhance your browsing experience, such as toolbars or programs that block pop-up ads from opening.

46. XP New Perspectives on the Internet, 4e Tutorial 9 46 Enhancing Your Use of the Internet with Browser Extensions Helper applications are independent programs that are stored on your computer and are activated automatically when needed. Plug-ins do their work inside the browser and do not activate a standalone program that is stored on your computer. When you install a Web browser, many popular plug-ins are often installed with it. If you do not have the required plug-in, you can download or purchase it. Most browser extensions are free from their developers.

47. XP New Perspectives on the Internet, 4e Tutorial 9 47 Enhancing Your Use of the Internet with Browser Extensions Browser extensions are often grouped into categories based on the type of content they deliver. These categories are:  Document and productivity  Image viewer  Multimedia  Sound player  Video player  Three-dimensional (3-D) graphics

48. XP New Perspectives on the Internet, 4e Tutorial 9 48 Document and Productivity Browser Extensions Document and productivity browser extensions let you use a browser to read documents, such as files saved in PDF format and viewed using Adobe Acrobat Reader. If you have Acrobat Reader, a browser can use it to display and print files with.pdf extensions. If you have installed Microsoft Office, a browser can start Word, Excel, and other Office programs to display files with extensions, such as.doc and.xls.

49. XP New Perspectives on the Internet, 4e Tutorial 9 49 Image Viewer Browser Extensions Browser extensions from this category let the browser display graphics, such as interactive road maps or alternative file formats and viewers for GIF and JPEG files. Image viewer plug-ins also display different picture file formats. If a Web site indicates you need a specific image viewer plug-in to view something on its site, you can usually download it at that time, directly from that site.

50. XP New Perspectives on the Internet, 4e Tutorial 9 50 Multimedia Browser Extensions Multimedia contains browser extensions that appeal to most of the senses. The Flash Player lets your Web browser display simple animations, user interfaces, static graphics, movies, sound, and text. The Shockwave Player is a more fully featured browser plug-in that you must download and install.

51. XP New Perspectives on the Internet, 4e Tutorial 9 51 Sound Player Browser Extensions Sound player browser extensions, such as Beatnik, Crescendo, and RealOne Player, let your Web browser play sounds. RealOne Player is a free plug-in that plays streaming audio and video files over the Internet. Beatnik and Crescendo deliver high-quality interactive music and sound on the Web. Buffered play downloads music and ques it for play when the transfer/play rate exceeds your modem’s speed so you do not have to wait for your browser to download the file.

52. XP New Perspectives on the Internet, 4e Tutorial 9 52 Video Player Browser Extensions Video player browser extensions deliver movies to Web browsers over the Internet. QuickTime was one of the first movie players developed. It plays video, sound and music for both Macintoshes and PCs. Other successful movie players include RealPlayer, Windows Media Player, and VivoActive PowerPlayer. Some of these players download a complete movie before playing it, while others use streaming technology to play a movie before it has been completely downloaded.

53. XP New Perspectives on the Internet, 4e Tutorial 9 53 3-D Browser Extensions Virtual Reality Modeling Language or VRML is an Internet programming language that creates three-dimensional environments that can mimic known worlds or define fictional ones. With VRML you can navigate and interact with a three- dimensional scene. VRML sites are used for gaming and product and location tours. Extensible 3D (X3D) is the next generation open standard for 3D on the Web.

54. XP New Perspectives on the Internet, 4e Tutorial 9 54 Finding Browser Extensions A good way to locate browser extensions is to visit a download site such as Tucows. Many download sites group plug-ins by the functions they perform, which makes it easy to view the available plug-ins for the type of files you want to use.

55. XP New Perspectives on the Internet, 4e Tutorial 9 55 Commonly Used Browser Extensions Browser ExtensionDeveloperDescription Adobe Acrobat Reader AdobeDisplays formatted document files saved in PDF format. Flash PlayerMacromediaDisplays simple animations, user interfaces, static graphics, movies, sound, and text. QuickTime PlayerApple Computer Plays audio and video files RealOne PlayerRealNetworksPlays files in different audio and video media formats.

56. XP New Perspectives on the Internet, 4e Tutorial 9 56 Commonly Used Browser Extensions Browser ExtensionDeveloperDescription Shockwave PlayerMacromediaDisplays animated, three- dimensional interfaces, interactive advertisements and product demonstrations, multi-user games, streaming CD-quality audio, and video. Windows Media Player Microsoft Corporation Plays files in different audio and video media formats.

57. XP New Perspectives on the Internet, 4e Tutorial 9 57 Summary There are different types of computer security threats and some countermeasures that you can take to prevent them. There are copyright issues related to the information you locate and use on the Internet. There are different categories of browser extensions that you might need as you use the Web. You should use the security information presented in this tutorial to create a safe environment in which to enjoy the Web’s many resources and games on your own computer.