1 / 77

Chapter 2

Chapter 2. Computer Security Basics. McGraw-Hill. Learning Objectives. Describe security threats and vulnerabilities to desktop PCs and users Identify methods for protecting against security threats. Troubleshoot common security problems. Threats to Computers and Users.

zeno
Download Presentation

Chapter 2

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Chapter 2 Computer Security Basics McGraw-Hill

  2. Learning Objectives • Describe security threats and vulnerabilitiesto desktop PCs and users • Identify methods for protecting against security threats. • Troubleshoot common security problems

  3. Threats to Computers and Users • Malware (Malicious Software) • Vectors: the mode of malware infection. • E-mail Vectors • Code on Web sites • Trojan horse • Searching for unprotected computers • Sneakernet–the oldest vector

  4. Trojan horse image Image: Carol and Mike Werner/Alamy

  5. Threats to Computers and Users • Malware (cont.) • Vectors: the mode of malware infection (cont.) • Back doors (ex, Code Red worm then Nimda worm) • Rootkits • Pop-up downloads • Drive-by downloads • War driving • https://www.youtube.com/watch?v=_dYnXpacdtA • Bluesnarfing

  6. Online videos show examples of war driving

  7. Threats to Computers and Users • Malware (cont.) • Stealing Passwords • Through Web sites • Using password crackers • Using keystroke loggers Hardware keystroke logger Product photo courtesy of www.keycobra.com

  8. Threats to Computers and Users • Malware (cont.) • Virus • A program installed and activated without the knowledge or permission of the user • Mischief or damaging results

  9. Threats to Computers and Users • Malware (cont.) • Worm • A virus that self-replicates • Travels between computer via many vectors • Netsky and MyDoom worms generated disabling amounts of network traffic

  10. Threats to Computers and Users • Malware (cont.) • Botnets and Zombies • A botnet is a group of networked computers that Infected with programs that forward information to other computers • Bot (short for robot) program acts as an agent. Can be used for good or evil • A zombie is a computer working mindlessly as part of the botnet

  11. Threats to Computers and Users • Malware (cont.) • Spyware • Gathers information and sends to the people who requested it. • Used to track surfing or buying patterns • Used for industrial espionage • Law enforcement uses spyware to track criminals • Governments use it to investigate terrorism

  12. Threats to Computers and Users • Malware (cont.) • Adware • Collects information about a user to display targeted advertisements • Display ads in pop-ups or banners • Clicking inside a banner or pop-up may trigger a pop-up download that installs a virus or worm

  13. Threats to Computers and Users • Malware (cont.) • Web Browser Hijacking • Home page points to a site the user did not select • Remedy by changing the default page in browser settings

  14. Threats to Computers and Users • Malware (cont.) • Spam and Spim • Spam: unsolicited e-mail • May be from legitimate or illegitimate source • May involve a scam • Perpetrators are called spammers • Spim: Spam over Instant Messaging • Bots (spimbots) collect instant messaging screen names • Spim message may contain links to product Web sites • Perpetrators are called spimmers

  15. Threats to Computers and Users • Social Engineering • Phishing • Fraudulent method of obtaining personal financial information through the use of messages that appear to be from legitimate organizations • Hoaxes • Take many forms • Example: E-mail seemingly from friend in trouble • Example: E-mail seemingly from Microsoft with a link to a fix

  16. Hoaxes take many forms Image: HenrikKettunen/Alamy

  17. Threats to Computers and Users • Social Engineering (cont.) • Enticements to open attachments • Fraud: The use of deceit and trickery to obtain money or other valuables

  18. Threats to Computers and Users • Identify Theft • Personal information stolen to commit fraud • A social security number and other key personal information is enough to steal someone’s identity • Exposure to Inappropriate or Distasteful Content • Invasion of Privacy

  19. FTC ID theft Web page

  20. Invasion of privacy Image: Troy Aossey/Digital Vision/Getting Images

  21. Threats to Computers and Users • Misuse of Cookies • Cookies may contain • User preferences from visiting a site • Information entered into a form at a Web site • Browsing activity • Shopping selections on a Web site • Cookies can be a convenience • Look for privacy statement • Banner ad creators use cookies to track surfing habits

  22. Threats to Computers and Users • Computer Hardware Theft • Keeping Track of New Threats • Federal Trade Commission (FTC) Bureau of Consumer Protection (www.ftc.gov/bcp) • The People Behind the Threats • Hackers • Crackers • Script Kiddies • Click Kiddies • Packet Monkeys

  23. Guard against computer theft Image: Image Source/Getty Images

  24. Computer accidents Image: R and R Images/Photographer’s Choice/Getty Images

  25. Figure 2-1 The FTC Bureau of Consumer Protection Web site

  26. Organized crime Image: Digital Vision/Getty Images

  27. Hacker Image: Comstock/Getty Images

  28. Defense Against Threats • Education • Some signs to look for are: • Strange screen messages • Sudden computer slowdown • Missing data • Inability to access the hard drive Image: artpartner-images.com/Alamyh

  29. Defense Against Threats • Education (cont.) • Non-computer activity of concern • Unexplained charges on credit accounts • Calls from creditors about overdue payments on accounts you never opened • A turndown when applying for new credit for reasons you know are not true • A credit bureau report of existing credit accounts you never opened

  30. Defense Against Threats • Security Policies • Define data sensitivity and data security practices • Exist in both document form and software form • Administrators configure computer security to enforce written policy • Password policy should require strong passwords and state complexity requirement that are enforced on computers

  31. Defense Against Threats • Install Comprehensive Security Software • Firewalls • Network-based Firewalls • Technology used in firewalls • IP packet filter • Proxy service • Encrypted authentication • Virtual private network (VPN) • Personal Firewalls • Come with most OSs • Come with third-party security software

  32. Figure 2-2 Security software with many bundled components

  33. Table 2-1 Firewall Technologies

  34. Figure 2-3 Security page from a Cisco Wireless-N Router

  35. Figure 2-4 A private network protected by a firewall

  36. Figure 2-5 This message can simply mean that you are using a third-party firewall, and Windows Firewall is disabled

  37. Defense Against Threats • Install Comprehensive Security Software (cont.) • Anti-Spam • Antivirus • Pop-Up Blockers • Privacy Protection/Controlling Cookies • Parental Controls

  38. Figure 2-6 Most spam filters have extensive configuration options

  39. Figure 2-7 The Internet Explorer Pop-up Blocker Settings page

  40. Figure 2-8 Use the top part of the privacy page in Internet Options to control the use of cookies

  41. Defense Against Threats • Install Comprehensive Security Software (cont.) • Content Filtering • Block or allow certain sites • May be part of multifunction package • May be included in browser • Services on Internet give ratings to Web sites • Configure filter to allow or disallow unrated sites • Content Advisor in Internet Explorer • Keep Up-to-Date with security patches

  42. Step-by-Step 2.01 Defense Against Threats Check Out the Content Advisor in Internet Explorer

  43. Figure 2-9 The Content tab in Internet Options

  44. Figure 2-10 Content Advisor page displays when you click the Enable button in Internet Options

  45. Defense Against Threats • Authentication and Authorization • Authentication • Verification of who you are • One-factor: Something you know (user name and password) • Two-factor: Something you know and something you have (token) • Three-factor authentication: Two-factor plus biometric data (retinal scan, voice print, or fingerprint)

  46. Defense Against Threats • Authentication and Authorization (cont.) • Authorization • Determines level of access • Includes both authentication and verification of access level • Permission is an action that a security account can perform on an object • User right is a systemwide action a security account can perform on a computer • Logging on • Installing device drivers

  47. Defense Against Threats • Passwords • Password: a string of characters entered for authentication • Don’t take for granted • Do not use same password everywhere • Defense against threats • Use long and complex passwords • Do not use common words

  48. Defense Against Threats • Security Account Basics • Security account assigned permissions and rights • User Accounts • Assigned to single person • Contains user name, password, and often more • Built-in user accounts • Administrator (Windows) • Root (Mac OS X and Linux • Guest (disabled by default • Account Types • Standard user • Administrator

  49. Figure 2-11 An administrator account may create accounts of either type

  50. Defense Against Threats • Security Account Basics (cont.) • Group Accounts • Contain one or more individual accounts • May contain other groups • Some built-in (Administrators, Users, Guests) • Some created when software is installed • Some created by Administrator

More Related