Unit 4 Security And Ethics

− Browser / client sends request to webserver for identification − Web server sends its digital / security certificate − Browser authenticates certificate − If authentic connection, is established any data sent is encrypted − Using public and private key to do this

− Handshake and record protocols − Client/Browser requests secure connection to web server − Browser requests server to identify itself − Web server then provides digital certificate after identification − Browser validates certificate − Browser sends signal to web server to begin transmission − Session key generated − Encryption method is agreed on The handshake protocol is used to exchange all the information needed by both computers in order to establish a secure SSL/TLS connection The record protocol handles the actual data and it’s encryption

• Browser sends URL to DNS using HTTP • DNS find matching IP address for URL and sends it to the browser • Browser requests web server for web pages • Web pages are then sent from web server to the web browser • Browser then renders the HTML to display web pages • Security certificates authenticated, SSL and TSL used to encrypt data sent to and fro

− Acts as mediator between the user’s computer and web server − Allows internet traffic to be filtered − Speed access to information on website using cache

− Encryption key used − Key uses algorithm to scramble data − Data before encryption is plain text − After encryption it is known as cypher text − Same key used to decrypt data

− Key is kept secret, only sender and receiver know − Sender uses same key to encrypt and decrypt − Key has to be sent over internet, can be intercepted − Less safe but fast

− Public and private key mathematically linked − Public key used to encrypt, anyone can see − Private key not transmitted, used to decrypt − Safer process but slower

− Webserver is sent multiple requests, requests flood the webserver at the same time − Webserver crashes / runs slow − Designed to prevent access to e.g. a website // Stops legitimate requests being processed/serviced

Copyright − law/legislation that requires permission to use intellectual property / other people’s work Plagiarism − To claim other’s work as your own − To use other people’s work without consent / acknowledgement − Theft of intellectual property

Lost from • Human error, accidentally deleting file • Hardware failure • Power failure or surge • Physical damage, fire or flood • Misplacing storage device Prevention • Back up data regularly • Use surge protection and UPS • Keep data in protective case • Use verification method for deleting file • Follow and educate on correct procedure of ejecting files, saving, etc.

• Phishing • Pharming • Spyware • Dos • Malware • Viruses • Worm • Rootkit • Backdoor

Anti-spyware • Scans computer for spyware • Removes/quarantines any spyware found • Prevent spyware from being installed Onscreen keyboard • Key-logger can’t collect data of key press • Can’t relay useful info to 3rd party 2 Factor Authentication • Extra data sent to device • Harder for hacker to obtain data • Data has to be entered into same system if entered from remote location not accepted Firewall • Can be software or hardware based • Monitors incoming and outgoing traffic • Allows criteria to be set • Blocks access to signal that do not meet criteria • Restricts access to specific applications

Anti-virus • Scans computer for viruses daily • Has a record of known viruses • Removes/Quarantines any virus found • Warns user of virus • Checks data before downloaded • Prevents download of virus found Firewall/Proxy server • Monitors incoming and outgoing traffic • Allows setting of criteria • Checks if traffic meets criteria • Blocks traffic that does not meet criteria

Firewall/Proxy server • Monitors incoming and outgoing traffic • Allows setting of criteria • Checks if traffic meets criteria • Blocks traffic that does not meet criteria Passwords • Use long and more random passwords • Change it regularly • Lock after a set attempts Biometrics • Data needed to enter is unique to individual • Hard to replicate • Lock after set attempts 2 Factor Authentication • Extra data sent to device • Hard for hacker to obtain • Data entered needs to be in the same system, if attempted from remote location it’s not accepted

Phishing − Legitimate looking email sent to user − encourages user to click a link that directs user to a fake website − User encouraged to enter personal details into a fake website // designed to obtain personal details from a user Pharming − Malicious code/malware is downloaded without users’ knowledge − That re-directs user to fake website (when legitimate URL entered) − User encouraged to enter personal details into a fake website − Designed to obtain personal and sensitive details from a user

Free software- • Type of software licence • Free of charge • Normally distributed without the source code • Can legally share / copy • Cannot legally modify code • Cannot resell Freeware- Owner has copyright for software but can be given away for free Shareware- Often a trial version of full software, fee required for full access

• Legal protection person can obtain to provide protection against their work stolen

Hacking − When a person tries to gain unauthorised access to a computer system − Data can be deleted/corrupted by hacker Malware − A software program designed to damage data / disrupt the computer system − Replicates itself and fills the hard disk Virus − A program that replicates itself to damage/delete files

• A set of guidelines • Rules that govern the use of computers • Tell people how to behave when using computers • Could be subjected to plagiarism/intellectual property theft • Could copyright their work to make it illegal to copy or steal it

-When someone alters a program source code usually for a backdoor (by disabling computer security software)