CPT 123 Internet Skills Class Notes Internet Security Session B

Internet Security Policy A security policy is a set of enforced rules and behaviors that applies to people and systems Policies should be considered by all Internet users Single-user computers Large Organizational LANs

Internet Security Policy Security policies vary according to type of user organizations Some organizations have unrestricted access policies Other organizations have very restrictive policies

Internet Security Policy Single user should be aware that the system is secure if no Internet server applications are loaded Most Internet Service provider’s have extensive security policies and are capable of serving data without exposure

Internet Security Policy If service provider provides server applications, single user preserves the security level of client computer Thus security for single user not necessary For organization password policies and security standards are necessary

Internet Security Policy Commonly used security policies Least restrictive policy - permit all users to access all resources - used for years on the Internet - can be disastrous - mainly academic or scientific communities

Internet Security Policy Trusted access requires password access and authentication for every resource - requires careful design and time to implement - requires encrypted verification and passwords for all inbound and outbound traffic - purpose to ensure information not transmitted to or from an unsecured location

Internet Security Policy No access - defeats the purpose of Internet attachment - organizations not attached to the Internet by default implement this policy - several commercial organizations are not connected to the Internet

Internet Security Policy Commercial organizations, government agencies, and military establishments need a highly structured security policy Academic and scientific communities need cautious policies Single users need to think about the policy they want to follow

Internet Security Policy Every organization has more than one exposure point concerning security if the are connected to the Internet Organizations need to determine exposure points and establish these areas as the focus of security policy

Internet Security Policy Typical areas of focus Network security - the goal is to prevent any unauthorized entry into the system Physical protection of hardware - the goal is to physically secure computers and develop a tracking system for equipment assigned to individuals within the organization

Internet Security Policy Access rules and regulations - establish who may and may not enter specified areas of the computer network Virus protection - includes methods for keeping the protection against the latest viruses up-to-date

Internet Security Policy Disaster recovery - requires planning for major shutdowns or loss of computer capability or file storage due to extended power outages, severe weather such as floods, tornadoes, and earthquakes Backup plans - the goal is to preserve critical information

Internet Security Policy Steps in developing a security policy determine what needs protection determine who should and should not have access to protected areas and at what level determine how protection will occur draft and approve a policy implement a policy maintain and update the policy

Internet Security Policy Security is the act of protecting computer resources and data from unwanted access and use Security risks come mainly from inside organizations but can also come from Internaut hackers, crackers, and attackers

Internet Security Policy In addition to system Internaut attackers, computer systems need protection from viruses Viruses rob computer resources and destroy valuable data

Internet Security Policy Methods of protecting involve the use of firewalls, user identification and authentication, and encryption Firewalls establish barriers to system entry from inside as well as outside Firewalls can be broken down into three generations of firewalls

Internet Security Policy Packet-filtering systems Bastion hosts Proxy gateways and stateful inspection Identification and authentication identification is the process of obtaining information from the user to determine authorization

Internet Security Policy Authentication is the process of the system establishing the identity of users asking for entry into the system Passwords, user Ids are identification techniques Smart cards and biometrics are authentication techniques Digital Ids or certificates us both techniques

Internet Security Policy Encryption uses a mathematical formula to code or scramble data for transmission over the Internet Receiving end decodes using a “key” that solves the mathematical problem and reassembles the message

Internet Security Policy Virus protection uses special software designed to detect and protect a computer system from viruses New viruses develop daily so organizations must continually monitor new viruses and adapt the virus protection software to keep pace