Policies and Security for Internet Access Photocopiable/digital resources may only be copied by the purchasing institution on a single site and for their own use

Links to Progress Leisure Pre-Release From Progress Leisure pre-release material: Security methods, including two-factor authentication Policies and procedures for Internet access ‘Customers log on to the website through a web browser or smartphone app using two-factor authentication.’ ‘Before using the wireless network, customers must agree to the Progress Leisure Acceptable Use Policy.’

Policy and Security – Single-factor Authentication Single-factor authentication (SFA) is where the user can obtain access to an account or service using one factor such as a password. Risky if same password used for many applications Recommend using unique password for each application

Policy and Security – Two-factor Authentication Two-factor authentication is a security method by which users obtain access by providing two separate factors to identify themselves. Three different types of factors that can be used for authentication are: Knowledge factor – knowing a password / PIN number Possession factor – owning a membership card / mobile Biometric factor – human characteristic fingerprint/DNA

Policy and Security – Two-factor Authentication Bank card reader example Customer needs: PIN number (knowledge) and Debit card (possession) to log in to their account Customer places card in reader and enters PIN number. The passcode displayed on the card reader is entered into a web login page to allow the customer account access.

Policy and Security – Two-factor Authentication Mobile transaction numbers (mTANs) example Member needs: Password (knowledge) Mobile phone (possession) This simple method of two-factor authentication would be suitable for Progress Leisure, as members only need knowledge of their password and possession of one of the following: Their laptop/tablet computer and their mobile phone Their smartphone for direct login Member enters username and password into Progress Leisure login page Progress Leisure receives login request from member and texts security code to member’s mobile phone Member then enters the security code to log in to the website

Policy and Security – Two-factor Authentication Two-factor authentication benefits Greater security than simply password protection Deterrent as hackers are likely to avoid this more secure system Two-factor authentication limitations Phone or card/reader needed to log on Customers dislike the extra time taken to log on

Policy and Security – Further Security Methods Password advice Use strong passwords with a mixture of numbers, letters, symbols and lower/upper case Change passwords regularly Access rights – set up by system administrator to limit network access to relevant files only for a user Encryption – used to make stored data more secure, by making it unreadable to people who do not have the key to decode it

Policy and Security – Hacking Firewall Firewall designed to check the integrity of incoming messages and requests for service from the system Suspicious messages or requests can be rerouted temporarily until the legitimacy has been established Intrusion detection systems (IDS) Designed to monitor the network or computer system for malicious activities If an incident is detected, a report is sent to the network management Further action taken if necessary to prevent any risks to the system

Policy and Security – Virus Protection Antivirus software Used to minimise the risk to data from viruses This software searches the computer system for viruses and deletes them once detected Treat files and attached email files from unknown sources with caution to avoid viruses getting into the system Spyware Spyware can be loaded into a computer system as a software virus Important to run an anti-spyware program which will prevent and detect spyware from being installed To remove any spyware that has previously been installed

Policy and Security – Acceptable Use Policy Progress Leisure has produced an acceptable use policy (AUP) for members who use their wireless network; it should contain the following sections: Purpose: to ensure that members of the centre understand what is appropriate browsing behavior, and to specify the directives necessary to protect the IT network infrastructure Acceptable Internet usage: Should include information on what members are encouraged to use Wi-Fi for, and that members must comply with current legislation. Unacceptable behaviour: Unacceptable behaviour to be listed in detail under the following headings: General and System Activities Progress Leisure Interactive Services Email and Communication Activities User Compliance: members need to sign and date that they have understood the acceptable use policy before using the system

Policy and Security: Questions Explain the following terms: (a) Single-factor authentication (2 marks) (b) Two-factor authentication, with examples of different types of factors (6 marks) Outline the process of two-factor authentication that Progress Leisure could use with a mobile transaction number approach. (6 marks) List two benefits and one limitation of using two-factor authentication. (3 marks) How might encryption be used to improve data security? (2 marks) Describe two techniques that can be used to prevent hacking of the system. (4 marks) Describe the purpose of the Progress Leisure Internet acceptable use policy. (2 marks) List three unacceptable behaviour issues with messages sent to the Progress Leisure social media site. (3 marks) Explain why Progress Leisure would make use of web monitoring software. (4 marks)