1. CPT 123 Internet Skills Class Notes Internet Security Session B

2. Internet Security Policy A security policy is a set of enforced rules and behaviors that applies to people and systems Policies should be considered by all Internet users Single-user computers Large Organizational LANs

3. Internet Security Policy Security policies vary according to type of user organizations Some organizations have unrestricted access policies Other organizations have very restrictive policies

4. Internet Security Policy Single user should be aware that the system is secure if no Internet server applications are loaded Most Internet Service provider’s have extensive security policies and are capable of serving data without exposure

5. Internet Security Policy If service provider provides server applications, single user preserves the security level of client computer Thus security for single user not necessary For organization password policies and security standards are necessary

6. Internet Security Policy Commonly used security policies Least restrictive policy - permit all users to access all resources - used for years on the Internet - can be disastrous - mainly academic or scientific communities

7. Internet Security Policy Trusted access requires password access and authentication for every resource - requires careful design and time to implement - requires encrypted verification and passwords for all inbound and outbound traffic - purpose to ensure information not transmitted to or from an unsecured location

8. Internet Security Policy No access - defeats the purpose of Internet attachment - organizations not attached to the Internet by default implement this policy - several commercial organizations are not connected to the Internet

9. Internet Security Policy Commercial organizations, government agencies, and military establishments need a highly structured security policy Academic and scientific communities need cautious policies Single users need to think about the policy they want to follow

10. Internet Security Policy Every organization has more than one exposure point concerning security if the are connected to the Internet Organizations need to determine exposure points and establish these areas as the focus of security policy

11. Internet Security Policy Typical areas of focus Network security - the goal is to prevent any unauthorized entry into the system Physical protection of hardware - the goal is to physically secure computers and develop a tracking system for equipment assigned to individuals within the organization

12. Internet Security Policy Access rules and regulations - establish who may and may not enter specified areas of the computer network Virus protection - includes methods for keeping the protection against the latest viruses up-to-date

13. Internet Security Policy Disaster recovery - requires planning for major shutdowns or loss of computer capability or file storage due to extended power outages, severe weather such as floods, tornadoes, and earthquakes Backup plans - the goal is to preserve critical information

14. Internet Security Policy Steps in developing a security policy determine what needs protection determine who should and should not have access to protected areas and at what level determine how protection will occur draft and approve a policy implement a policy maintain and update the policy

15. Internet Security Policy Security is the act of protecting computer resources and data from unwanted access and use Security risks come mainly from inside organizations but can also come from Internaut hackers, crackers, and attackers

16. Internet Security Policy In addition to system Internaut attackers, computer systems need protection from viruses Viruses rob computer resources and destroy valuable data

17. Internet Security Policy Methods of protecting involve the use of firewalls, user identification and authentication, and encryption Firewalls establish barriers to system entry from inside as well as outside Firewalls can be broken down into three generations of firewalls

18. Internet Security Policy Packet-filtering systems Bastion hosts Proxy gateways and stateful inspection Identification and authentication identification is the process of obtaining information from the user to determine authorization

19. Internet Security Policy Authentication is the process of the system establishing the identity of users asking for entry into the system Passwords, user Ids are identification techniques Smart cards and biometrics are authentication techniques Digital Ids or certificates us both techniques

20. Internet Security Policy Encryption uses a mathematical formula to code or scramble data for transmission over the Internet Receiving end decodes using a “key” that solves the mathematical problem and reassembles the message

21. Internet Security Policy Virus protection uses special software designed to detect and protect a computer system from viruses New viruses develop daily so organizations must continually monitor new viruses and adapt the virus protection software to keep pace