1

Lecture 9: The Internet And Security

J. S. Chou, P.E., Ph.D.

2

Objectives

1. Understand the role of telecommunications in organizations

2. Describe the Internet and how it works

3. Describe the basic Internet services and the use of the World Wide Web

4. Explain what is meant by the term “information systems security” and describe various approaches for ensuring information systems security

3

Key Terms

TelecommunicationsTransmission of all forms of communication including digital data, voice, fax, sound, and video from one location to another over some type of network

TelecommunicationsTransmission of all forms of communication including digital data, voice, fax, sound, and video from one location to another over some type of network

NetworksA group of computers and peripheral devices connected by a communication channel capable of sharing information and other resources among users

NetworksA group of computers and peripheral devices connected by a communication channel capable of sharing information and other resources among users

BandwidthIs the carrying capacity of a telecommunications network. (i.e. the size of the telecommunications channel or the pipe)

BandwidthIs the carrying capacity of a telecommunications network. (i.e. the size of the telecommunications channel or the pipe)

4

Sample of Interpersonal Use of Telecommunications

5

Sample of Interpersonal Use of Telecommunications

6

Sample of Business Use of Telecommunications

7

Sample of Business Use of Telecommunications

8

History of the Internet

ARPANET (Advanced Research Project Agency Network• Created in the 1960s by DARPA (Defense Advance

Research Projects Agency)• Used by government and universities as a means of

communicating for research purposes

NSFNET (National Science Foundation Network)• Created in 1986 by the National Science Foundation for

connecting research institutions• Connected to ARPANET and many others (BITNET,

CSNET, etc) to become a major component of the Internet

Internet Support• Ongoing support comes from many universities, federal

and state governments, and national international research institutions and industry

9

How the Internet Works – TCP/IP & Routers

TCP – Transmission Control Protocol• Breaks information into small chucks called data packets• Manages the transfer of the packets from computer to computer• Reassembles data packets into a message at the destination

IP – Internet Protocol• Controls how data packets are formed• Addresses each packet with the source and destination address• A data packet conforming to the IP spec is called an IP datagram

Routers• Connect one network to another• Identify each device on a network as unique using IP protocol• Serve as the “Traffic Cop” directing packets to their destination

TCP/IP Approach

10

How the Internet Works – Connecting Networks

(Computer A) TCP - Breaks message into data packetsIP - Adds address of destination Computer D

Example: Sending a message from Computer A to D

(Computer D) TCP - Checks for missing packets, reassembles message,discards duplicatepackets

(Router) Reads IP Address of packet, routes message to Network 2 and Computer D

1 3

2

11

How the Internet Works – Connecting Multiple Networks

Backbone Network• Manages the bulk

of network• Typically a higher

speed protocol than individual LAN segments (e.g. uses fiber-optic cable which transfers data at 2 gigabits/second vs. LAN speed at 10 megabits/second)

12

How the Internet Works – Web Addresses & Domains

Domain• Identifies the Website (host)• Comes in many suffixes

such as:.edu (educational

institutions).org (organizations; non-

profit).mil (military).net (network

organizations)

Example: microsoft.com(URL) Uniform Resource Locator• Identifies particular Web pages within a domain

Example: http://www.microsoft.com/security/default.mspx

IP Address• Each domain is associated

with one or more IP addresses

• Format: a 32-bit address written as 4 numbers (from 0-255) separated by periods

Example: 1.160.10.240

13

How the Internet Works – Managing the Internet

Domain Name System (DNS)• Maintained by the Internet Registry• Used to associates hosts or domains with IP addresses• Root DNS database is replicated across the Internet

14

How the Internet Works – Connecting to the Internet

Modem (stands for Modulate/Demodulate)• A modem convert signals back and forth from digital to

analog for transmission and receipt between computers• A computer requires a modem to get access to the Internet

Internet Service Provider (ISP)• These companies provides access to the Internet for a fee• A computer is connected to an ISP through a modem to

allow Internet access

Network Access Points (NAPs)• NAP’s connect ISP’s together• They serve as Internet access points for the ISPs and serve

as exchange points for Internet traffic

Internet Backbone• Collection of main network connections and

telecommunications lines that make up the Internet

15

How the Internet Works – Shows the Internet Backbone

16

Network Connection Types

DSL (Digital Subscriber Line)• Uses special modulation schemes to fit more data into

existing telephone copper wires• Up to 12x faster than ISDN with same distance requirements.• Requires a modem but allows simultaneous phone service

POTS (Plain Old Telephone Service)• Also called PSTN Public Switched Telephone Network• Uses a dial-up modem and existing copper telephone wires• Has the slowest transmission rates for access

ISDN (Integrated Services Digital Network)• A universal digital network standard used around the world• Usually no modem required and uses existing copper wires• Much faster than POTS…requires an exchange within 22k ft.

17

Network Connection Types

Wireless• Fixed wireless access points allow computers with access

cards to access ground-based networks (e.g. DSL, cable)• Mobile wireless devices (e.g. phones, PDAs) can access

networks using mobile wireless networks (e.g. cellular)

Cable Modem• Uses cable television coaxial cable to transmit the signal and

can be used while simultaneously watching TV• Requires a modem and offers speeds comparable to DSL

IoS (Internet over Satellite)• Uses a satellite dish to connect a computer to the Internet• IoS is usually slower than land-based options (DSL, Cable)• Many times the only option in remote areas

18

Network Connection Types

SONET (Synchronous Optical Network)• Not used for typical business activity• Up to a 1000 times faster than T1• Used in high volume transmission activities

T1/T3 (Trunk Level 1 or 3)• Dedicated digital lines that are used for high volume traffic

by large organizations who purchase from exchange carriers• T1 is 28 times faster than POTS,T3 is 28 times faster than T1

ATM (Asynchronous Transfer Mode)• A method of transmitting voice, video, and data over high-

speed LANS at very fast rates (28 times faster than T3)• Packet-based method with the potential to eliminate routers,

allocated bandwidth, and communications media contention

19

Current State of the Internet

20

What are People Doing on the Internet

21

World Wide Web

Web Browser

Hypertext• A Web page stored on a Web server• Contains information and links to

other related information (hyperlinks)

HTML (Hypertext Markup Language)• A standard method used to specify

the format of Web pages• Uses codes/tags which stipulate how

the content should appear to the user

Web Browser• A software program used to locate

and display Web pages• Includes text, graphics, and

multimedia content

22

World Wide Web

HTTP (Hypertext Transfer Protocol)• A protocol used to process user

requests for displaying Web pages from a Web server

Web Servers• A special computer that is

specifically designed to store and “serve up” Web pages

• This machine contains special hardware and software to perform its many specialized functions

23

World Wide Web - Architecture

24

How the Internet Works – Connecting to the Internet

Electronic BrochureA display-only site that allows a company to disseminate sales and marketing information

Online OrderingA function in addition to Electronic Brochure that allow customers to order and pay for products and service online

Electronic MarketplacesA mechanism to bring together buyers and sellers providing a vehicle for them to trade with each other (e.g. eBay)

Online Customer ServiceUsed to enhance traditional customer service but providing information on the Website to help customers resolve issues

25

Information System Security

IS SecurityPrecautions taken to keep all aspects of information systems safe from unauthorized use access

IS SecurityPrecautions taken to keep all aspects of information systems safe from unauthorized use access

Managerial MethodsSeveral techniques are commonly used to manage information systems security:

• Risk Assessment• Controlling Access• Organizational Policies and Procedures • Backups and Recovery

Managerial MethodsSeveral techniques are commonly used to manage information systems security:

• Risk Assessment• Controlling Access• Organizational Policies and Procedures • Backups and Recovery

Security ResourcesA number of organizations exist to raise awareness, research, develop standards, and advise on solutions for Internet security (e.g. CERT/CC, CSD, CSIT)

Security ResourcesA number of organizations exist to raise awareness, research, develop standards, and advise on solutions for Internet security (e.g. CERT/CC, CSD, CSIT)

26

Information System Security – Managerial TechniquesAssessing Risk• Security Audit identifies all aspects of information systems

and business processes that use them• Risk Analysis assesses the value of assets being protected• Alternatives based on Risk Analysis:

• Risk Reduction – implementing active counter measures to protect systems (e.g. firewalls)

• Risk Acceptance – implementing no counter measures• Risk Transference – transferring risk…buying insurance

Controlling AccessKeeping information safe by only allowing access to those that require it to do their jobs• Authentication – verifying identity before granting access (e.g. passwords)• Access Control – Granting access to only those system areas where the user is authorized (e.g. accouting)

27

Information System Security – Managerial Techniques

Organizational Policies and Procedures• Acceptable Use Policies – formally document how systems

should be used, for what, and penalties for non-compliance

Backups and Disaster Recovery• Backups – taking periodic snapshots of critical systems data

and storing in a safe place or system (e.g. backup tape)• Disaster Recovery Plans – spell out detailed procedures to

be used by the organization to restore access to critical business systems (e.g. viruses or fire)

• Disaster Recovery – executing Disaster Recovery procedures using backups to restore the system to the last backup if it was totally lost

28

State of IS Security - Security Threats & Technologies

Security TechnologiesCompanies and research organizations continue to develop and refine technologies to prevent security breaches. Some Include:• Firewalls• Biometrics• VPN and Encryption

Security ThreatsToday we hear about many security breaches that affect organizations and individuals. Some recently in the news:• Identity Theft – gaining access to some ones personal

information allowing them to imitate you (stolen laptop) • Denial of Service – attacks on websites using zombie

computers that overwhelm the site and shuts it down• Others: Spyware, Spam, Wireless Access, Viruses

29

IS Security: Technology

Firewall Techniques• Packet Filter – examine each packet entering and leaving

network and accept/reject based on rules• Application Level Control – Performs certain security

measures based on a specific application (e.g. file transfer)• Circuit Level Control – detects certain types of

connections or circuits on either side of the firewall• Proxy Server – acts as, or appears as an alternative

server that hides the true network addresses

FirewallsA system of software, hardware or both designed to detect intrusion and prevent unauthorized access to or from a private network

30

Security Technology: Firewall Architecture - Home

31

Security Technology: Firewall Architecture - LAN

32

Security Technology: Firewall Architecture – Enterprise

33

Security Threat: Spyware, Spam, and Cookies

CookiesA message passed to a browser from a Web server. Used by legitimate programs to store state and user information• Problems: can be used to track user activities• Prevention: browser settings, firewall

SpywareAny software that covertly gathers information about a user through an Internet connection without the users knowledge• Problems: uses memory resources, uses bandwidth, and can cause system instability• Prevention: Firewalls and Spyware software

SpamElectronic junk mail or junk newsgroup postings usually for purpose of advertising for some product and/or service• Problems: nuisance, wastes time deleting, uses storage• Prevention: Spam Blocker software

34

Security Technology: Biometrics

Biometrics• A sophisticated authentication

technique used to restrict access to systems, data and/or facilities

• Uses biological characteristics to identify individuals such as fingerprints, retinal patterns in the eye, etc. that are not easily counterfeited

• Has great promise in providing high security

35

Security Threat: Access to Wireless

Unauthorized Access to Wireless NetworksWith the prevalence in use of wireless networks this threat is increasing• Problems - Drive-by hacking an attacker accesses the

network, intercepts data from it, and can use network services and/or sends attack instructions without entering the building

• Prevention - Encryption between network and user devices

36

Security Technology: VPN and Encryption

VPN (Virtual Private Network)• Called a secure tunnel• Dynamically generated network connection to connect

users or nodes • This approach uses both authentication and encryption• Used extensively for remote access by employees

Encryption• The process of encoding messages before they enter the

network or airwaves, and then decoding at the receiving end• Public Key - known and used to scramble messages (SSL)• Private Key - not known and used by receiver to descramble

37

How Encryption Works

38

Security Threat: Viruses

VirusesPrograms that can attack a computer and/or a network and delete information, disable software, use up all system resources, etc.

Prevention Steps: AntiVirus software: install this software which is designed to block all known viruses and offers automatic or manual updates to virus patterns to block future virusesNo Disk Sharing – Viruses can be transferred to clean computers by inserting disks containing infected filesDelete Suspicious Email Messages – Do not open suspicious e-mail messages…Delete Only!Report Viruses – If you get a virus, report it to you network administrator immediately!