Information Security

1. Information security refers to the protection of information systems and the information they manage against unauthorized access, use, manipulation, or destruction, and against the denial of service to authorized users. Information Security Machine-Level Security Network Security Internet Security Concepts > Information Security In this section:

2. Machine-level security refers to actions taken to protect information on a computer that may or may not be connected to a computer network or the Internet. Machine-Level Security Authentication Encryption Data Backup Concepts > Information Security > Machine-Level Security In this section:

3. Authentication is a security process in which the identity of a person is verified. Authentication Concepts > Information Security > Machine-Level Security > Authentication • Facial pattern recognition is a form of biometrics that uses a mathematical technique to measure the distances between points on the face.

4. Encryption Encryption is a security technique that uses high-level mathematical functions and computer algorithms to encode data so that it is unintelligible to all but the intended recipient. When sending confidential data over the Web, make sure to use a secure connection, indicated by the https:// in the address bar and the closed lock icon at the bottom of the screen. Concepts > Information Security > Machine-Level Security > Encryption

5. Data Backup Data backup is a process in which copies of important computer files are stored in a safe place to guard against data loss. Operating systems usually provide a backup utility for data files. Typical backup software collects the files you wish to back up into a compressed file called an archive. With the advent of cloud computing, users are storing increasing amounts of data in services provided by Google, Yahoo!, Microsoft, Flickr, Facebook, and other Web 2.0 applications. Businesses sometime use a technology called Redundant Array of Independent Disks (RAID) to keep a mirror copy of all data on the system. Should the primary system fail, the RAID kicks in, allowing uninterrupted operations. Concepts > Information Security > Machine-Level Security > Data Backup

6. Data Backup Data backup is a process in which copies of important computer files are stored in a safe place to guard against data loss. A system recovery disk, sometimes called a rescue disk, is used to regain access to a computer that has lost its ability to boot normally. With the advent of cloud computing, users are storing increasing amounts of data in services provided by Google, Yahoo!, Microsoft, Flickr, Facebook, and other Web 2.0 applications. Concepts > Information Security > Machine-Level Security > Data Backup

7. Network Security Network security is concerned with addressing vulnerabilities and threats in computer networks that may or may not be connected to the Internet. Concepts > Information Security > Network Security

8. Permissions Permissions, or file system permissions, refer to the specific access privileges afforded to each network user and each system resource in terms of which files, folders, and drives each user can read, write, and execute. The system administrator has full access to the systemand sets the access rights of users or groups of users for system resources. Users have the power to set permissions for the files they own. Concepts > Information Security > Network Security > Permissions

9. Interior Threats Interior threats are network security threats that originate from within a network, typically from registered users. • Unintentional threats can occur when users make mistakes, such as data entry errors,or exceed their authorization. • Intentional threats come from registered users who desire to do the system harm or steal information. Concepts > Information Security > Network Security > Interior Threats

10. Information Theft Information theft refers to the access of information by an unauthorized person for financial gain or other benefit. • Such stolen information can be used by • identity thieves to make purchases using the victim’s identity • by unethical businesses to gain an advantage in a competitive market • hackers to illegally access computer accounts • spammers to target advertisements at consumers • competing nations in cyber warfare. Concepts > Information Security > Network Security > Information Theft

11. Network Usage Policy A network usage policy is a document, agreement, or contract that defines acceptable and unacceptable uses of computer and network resources for a business or organization. Midwestern State University Resnet Acceptable Usage Policy Concepts > Information Security > Network Security > Network Usage Policy

12. Wireless Security Wireless security refers to the unique threats and defenses associated with wireless computer networks. Wi-Fi networks are centered on a telecommunications device called an access point. The access point sends and receives signals to and from computers on the wireless local area network or WLAN. By default, access points are set to broadcast their presence. Concepts > Information Security > Network Security > Wireless Security

13. Wireless Security Attackers located within the range of the wireless signal, perhaps on the floor above or in a car parked outside, can attack a wireless network to gain access. • To protect your wireless home network: • Change the default password for your access point to something unique • Add encryption to your network communications through settings on your router, preferably WPA2 encryption • Set your router to connect to only the SSIDs of your computers • Set your access point so it does not automatically broadcast its existence Concepts > Information Security > Network Security > Wireless Security

14. Internet security refers to the unique threats and defenses associated with computers connected to the Internet. Internet Security Hacker Firewall Software Patch Malware Antivirus Software Botnet Concepts > Information Security > Internet Security In this section: • Cyber Warfare • Identity Theft • Internet Fraud • Digital Certificate • Phishing Scam • Spam • Virus Hoax

15. Hacker A hacker is an individual who subverts computer security without authorization. Concepts > Information Security > Internet Security > Hacker

16. Hacker Some of the most common types include: Black-hat hacker: Take advantage of security vulnerabilities to gain unlawful access to private networks for the purpose of private advantage White-hat hacker: Hack into networks in order to call attention to flaws in security so that they can be fixed Gray-hat hacker: A hacker of questionable ethics Script kiddie: A person with little technical knowledge who follows the instructions of others to hack networks. Concepts > Information Security > Internet Security > Hacker

17. A firewall is network hardware or software that examines data packets flowing in and sometimes out of a network or computer in order to filter out packets that are potentially dangerous. Concepts > Information Security > Internet Security > Firewall A firewall acts as a barrier that examines and blocks specified data packets from a network or computer. Firewall

18. Malware is short for “malicious software,” and includes any software designed to damage, corrupt, or illegally manipulate computer resources. Common forms include Viruses Worms Spyware. Concepts > Information Security > Internet Security > Malware Malware

19. Antivirus Software Concepts > Information Security > Internet Security > Antivirus Software Antivirus software, also known as virus scan software, uses several techniques to find viruses, worms, and spyware on a computer system; remove them if possible; and keep additional viruses, worms, and spyware from infecting the system. Besides using antivirus software, knowledge and caution play a big part in protecting PCs against viruses and worms.

20. Botnet A botnet, or botnet army, refers to a collection of computers autonomously or automatically working together toward some goal; often zombie computers that are synchronized to perform illegal activities on the Internet. Concepts > Information Security > Internet Security > Botnet In 2007, a botnet was used to bring down the information infrastructure of the country of Estonia, in an act that the country viewed as a military attack.

21. Identity Theft Identity theft is the criminal act of stealing information about a person to assume that person’s identity to commit fraud or other crimes. People can protect themselves from identity theft by being cautious with their personal information Concepts > Information Security > Internet Security > Identity Theft

22. Identity Theft Identity thieves use several methods to steal personal information. • In a technique called dumpster diving, personal information can be found by going through someone’s trash. • Phishing is a technique used to trick a person into providing personal information on a fake Web site that looks like a reputable Web site. • Social engineering is a technique that uses social interaction to manipulate individuals to give up personal information.

23. Cyber Warfare Cyber warfare extends traditional forms of warfare to the Internet and the Web, including espionage, psychological warfare, and attacks. • Cyberterrorism extends traditional forms of terrorism to the Internet and the Web. Concepts > Information Security > Internet Security > Cyber Warfare

24. Internet Fraud Internet fraud is the crime of deliberately deceiving a person over the Internet in order to damage them or to obtain property or services unlawfully. The most common form of Internet fraud is Internet auction fraud, accounting for a little more than one third of fraud cases. Auction fraud involves being swindled by sellers or buyers on auction sites like eBay. Concepts > Information Security > Internet Security > Internet Fraud

25. Digital Certificate A digital certificate, also called an SSL certificate, is a type of electronic business card that is attached to Internet transaction data to verify the sender of the data. An SSL connection is when digital certificates are combined with Secure Sockets Layer (SSL). It enables encrypted communications to occur between web server and browser. • Digital certificate information includes the name of the company to whom the certificate was issued. Concepts > Information Security > Internet Security > Digital Certificate

26. Phishing Scam A phishing scam combines both fraudulent e-mail and Web sites in order to trick a person into providing private information that can be used for identity theft. • In the criminal act of pharming, hackers hijack a Domain Name System (DNS) server to automatically redirect users from legitimate Web sites to spoofed Web sites in an effort to steal personal information. Concepts > Information Security > Internet Security > Phishing Scam

27. Spam Spam refers to unsolicited junk e-mail typically sent to advertise products and services. Concepts > Information Security > Internet Security > Spam

28. Virus Hoax A virus hoax is an e-mail or popup window that warns of a virus that doesn’t exist in order to confuse or get users to take actions that harm their own computers. Concepts > Information Security > Internet Security > Virus Hoax

29. Concepts > Information Security > Internet Security > Software Patch Software Patch A software patch, sometimes called a security patch, fixes software bugs and flaws, and is typically distributed to software users through online software updates. The vast majority of hacker exploits take advantage of the security holes in Internet software. Keeping software up to date and using firewall software are two of the most important steps to take to ensure information security.

30. Concepts > Information Security > Internet Security > Software Patch Software Updates Software updates are distributed to customers over the Internet, and the process of applying them is typically automatic. Many programs use the Internet to check periodically to see if an update is available. When an update is discovered, the patch may be downloaded automatically or the user may be prompted to download it. In either case, the user is then asked to click to install the update. Most software companies offer free and regular software updates for their products.

31. Getting software for Security Ninite has a nice convenient place to download softwaresafely.