INTRODUCTION TO

COMPUTER
SECURITY
Security Terminology, Password
Guidelines, E-mail and Web Security
 Lecturer | Kasawuli Bawonga | [email protected] |
TOPICS OF CONVERSATION
 Common Security Terminology

0712-925247 | 0700124500
 Password Security

 E-mail Security

 Web Security

 Peer-to-Peer File sharing

COMMON SECURITY

Lecturer | Kasawuli Bawonga | [email protected] |

TERMINOLOGY
 Password Cracking

0712-925247 | 0700124500
 Biometrics
 Public Key Cryptography
 SSL
 Man-in-the-Middle Attack
 Zombies
 Denial of Service Attack
 Key Logging Software
 Firewalls
 Security Exploit
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Password Cracking

0712-925247 | 0700124500
 Password Cracker
 An application that tries to obtain a password by
repeatedly generating and comparing encrypted
passwords or by authenticating multiple times to an
authentication source.
 Repeatedly trying to access your accounts

 Common methods of Password cracking

 Brute Force
 Dictionary
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Password Cracking (cont’d)

0712-925247 | 0700124500
 Passwordsare usually stored in an encrypted
form with a one way encryption algorithm
 If this data is compromised, password cracking can be
moved to a standalone system for easier control and
speed of cracking.
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Biometrics

0712-925247 | 0700124500
 Science and technology of measuring and
statistically analyzing biological data

 When used in Information Technology it usually

refers to the use of human traits for
authentication

 Thismethod can include fingerprints, eye retinas

and irises, voice patterns, and a host of other
consistent biological data
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Public Key Cryptography

0712-925247 | 0700124500
 Two Keys, “certificates”, are available for each
resource, one public and one private
 As the names imply, the public key can be shared
freely while the private key is kept secret
 Items encrypted using the public key are
decrypted using the private key and conversely
anything encrypted with the private key can be
decrypted with the public key
 This method of encryption is used to ensure
secure communication is only between a valid,
“known”, sender and recipient
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 SSL

0712-925247 | 0700124500
 “Secure Sockets Layer”
 Uses Public Key Cryptography
 Negotiates a method to encrypt communication
between a client and server
 Allows other network protocols to connect “over
top” of it, such as web browsing and e-mail
protocols
 “Transport Layer Security” (TLS) is a variant of
SSL used to negotiate encryption within the
network protocol being used
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Man-in-the-Middle Attack

0712-925247 | 0700124500
A system between two hosts that either passively
watches traffic to gain information used to
“replay” a session or actively interferes with the
connection, potentially imitating the remote
system
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Zombies

0712-925247 | 0700124500
 Computer system infected by a virus or Trojan
horse that allows the system to be remotely
controlled for future exploits

 These systems may be used to send large

amounts of spam e-mail or take part in
Distributed Denial of Service (DDoS) attacks
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Denial of Service Attack (DoS)

0712-925247 | 0700124500
 Sendinglarge amounts of data and requests to a
remote system in order to inundate the remote
computer or network

A Distributed DoS is a coordinated effort by a

number of systems to perform a DoS on a single
host
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Key Logging Software / Hardware

0712-925247 | 0700124500
 Software installed on a system to capture and log
all keystrokes
 Hardware installed between the keyboard and
computer used to capture and log all keystrokes

 Security Exploit
A software bug, or feature, that allows access to
a computer system beyond what was originally
intended by the operator or programmer
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Firewall

0712-925247 | 0700124500
 Network hardware device or software used to
filter traffic to and from the connected
resources

 Ranges from simple filters, blocking certain

services and protocols, to more complex systems
that plot network traffic patterns

 Localoperating system firewalls are referred to

as “personal firewall software”
Lecturer | Kasawuli Bawonga | [email protected] |
0712-925247 | 0700124500
Firewall
 Lecturer | Kasawuli Bawonga | [email protected] |
TERMINOLOGY
 Where you can find more technology

0712-925247 | 0700124500
definitions

 www.webopedia.com

 www.whatis.com

 www.techweb.com

 www.computeruser.com

 www.google.com
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Password limitations

0712-925247 | 0700124500
 Reasons for complex passwords

 Helpful suggestions for creating complex

passwords

 Future password requirements

 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 According to CERT/CC (Computer Emergency

0712-925247 | 0700124500
Response Team / Coordination Center)
approximately 80% of all network security
issues are caused by bad passwords

 Computer to Computer authentication can

use large keysets and complex encryption
while Human to Computer authentication
relies on much easier methods
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Password Limitations and why they are in
place

0712-925247 | 0700124500
 Password Expiration
 Decreases the chances of your password being cracked
 Complex Passwords
 Requiring complexity actually increases the possible
character combinations required by brute-force
cracking
 Password Length Requirements
 The longer your password the more possible character
combinations are present and the harder it is to crack
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Dealing with Password Limitations

0712-925247 | 0700124500
 Password lockouts
 If a certain number of login attempts fail within a
given timeframe the account is automatically locked
out for a preset amount of time
 Using this limitation stops brute force authentication
attempts

 Dictionary Checks
 Simple checks against common dictionaries are used
to increase password complexity
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Are Password rules too complex?

0712-925247 | 0700124500
 Withthe increase of computer hardware speed
and the decrease of computer prices, we can use
more advanced methods to keep security high

 Post-it Notes
 Is your computer in a locked room?
 Who has physical access to your system?
 A majority of system attacks originate through the
network.
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Suggestions for Complex Passwords

0712-925247 | 0700124500
 Thinkof a phrase and use the first characters of
each word, mixing case and adding numbers and
special characters
 It is good to change your password every 6 months =
Iig2cyPe6m
 UI vandals are number one = UiVdlsR#1
 Usinga favorite word or phrase and breaking it
up with numbers and special characters
 Happy = Hap3py1
 Motorcycle = M0tor6cyc!e
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Possible Future Password Requirements

0712-925247 | 0700124500
 Decreasing password expiration time

 Certificate authentication

 Use of Biometrics

 Twopart identification, where you use a

password and another physical item
 Lecturer | Kasawuli Bawonga | [email protected] |
PASSWORD SECURITY
 Passwords are like Underwear!

0712-925247 | 0700124500
 Don’t leave yours lying around

 Don’t Share them with friends

 The longer the better (cold weather)

 Change yours often

 Be mysterious
 Lecturer | Kasawuli Bawonga | [email protected] |
E-MAIL SECURITY
 Some common E-mail protocols

0712-925247 | 0700124500
 Secure E-mail protocols at the UI
 Lecturer | Kasawuli Bawonga | [email protected] |
E-MAIL SECURITY
 Common E-mail protocols

0712-925247 | 0700124500
 POP
 Post Office Protocol
 Older protocol for downloading messages from an INBOX
 IMAP
 Internet Message Access Protocol
 Full featured mail folder access
 SMTP
 Simple Mail Transfer Protocol
 Standard for sending and receiving e-mail between clients and
servers, and from server to server
 MAPI
 Mail Application Programming Interface
A set of communication methods and standards used
predominately between Microsoft e-mail clients and servers
 Lecturer | Kasawuli Bawonga | [email protected] |
E-MAIL SECURITY
 Secure protocols in place at the University of

0712-925247 | 0700124500
Idaho
 POPS
 Pop mail over an SSL connection
 IMAPS
 IMAP over an SSL connection
 SMTP+TLS
 Negotiation of a TLS/SSL connection after connecting
 All
popular e-mail clients support the use of
these protocols
 Lecturer | Kasawuli Bawonga | [email protected] |
WEB SECURITY
 Web specific definitions

0712-925247 | 0700124500
 HTTP
 URL
 SSL
 Spyware/ Adware
 Web browser updates

 Some common methods of Web Security

 Lecturer | Kasawuli Bawonga | [email protected] |
WEB SECURITY
 HTTP (Hyper Text Transfer Protocol)

0712-925247 | 0700124500
 Modern web browsers are capable of using
multiple protocols to download content although
most data transfers use HTTP

 URL (Uniform Resource Locator)

 “Web Address”
 protocol://server/resource
 http://www.uidaho.edu/registrar
 Lecturer | Kasawuli Bawonga | [email protected] |
WEB SECURITY
 SSL (Secure Sockets Layer)

0712-925247 | 0700124500
 Veryimportant on insecure networks such as
wireless

 How to verify SSL in a browser

 https: -- the web address begins with https meaning
the connection is using HTTP over SSL
 Look for a lock icon
 Internet Explorer may display a Security Alert that
states “you are about to view pages over a secure
connection”
 Lecturer | Kasawuli Bawonga | [email protected] |
WEB SECURITY
 SSL (cont’d)

0712-925247 | 0700124500
 Certificate Authorities
 A “CA” is an entity that issues certificates

 If you “trust” a CA you will trust the certificates

issued by that CA

 Web browsers come with a standard collection of

common certificate authorities including Verisign,
Geotrust, Thawte, and a number of others

 Be wary of untrusted certificates as it has the

potential of being a man-in-the-middle attack
Lecturer | Kasawuli Bawonga | [email protected] |
0712-925247 | 0700124500
WEB SECURITY
SSL (cont’d)

 Lecturer | Kasawuli Bawonga | [email protected] |
WEB SECURITY
 Spyware / Adware

0712-925247 | 0700124500
 Spyware is software designed to intercept or
take partial control of a computer with out the
express consent of the operator
 Adware is similar to spyware except it is used
primarily for advertising purposes and may have
provided the user with information about its
operation
 Regardless of the network level security, when
browsing, spyware will have access to your data
 Lecturer | Kasawuli Bawonga | [email protected] |
WEB SECURITY
 Web Browser Software Updates

0712-925247 | 0700124500
 Update, Update, Update

 Securityexploits can use your web browser to

access your system, install software, delete
data, spread viruses, and much, much more.
 Lecturer | Kasawuli Bawonga | [email protected] |
PEER-TO-PEER FILE SHARING
 What is Peer-to-Peer File sharing

0712-925247 | 0700124500
 Common applications

 Common issues to consider when using P2P

 How to protect yourself when using P2P

 Lecturer | Kasawuli Bawonga | [email protected] |
PEER-TO-PEER FILE SHARING
 Peer-to-Peer File sharing, or P2P, is using

0712-925247 | 0700124500
software to facilitate the transfer of data
between two systems without the need for a
central file server

 Common P2P applications are:

 Kazaa
 eDonkey
 Morpheus
 Gnutella Clients (Limewire, Bearshare)
 Lecturer | Kasawuli Bawonga | [email protected] |
PEER-TO-PEER FILE SHARING
 Common issues with P2P file sharing

0712-925247 | 0700124500
 Copyright issues

 Spyware / Adware

 Zombies
 Remote control
 Key logging

 Security exploits

 Sharing unexpected information

 Lecturer | Kasawuli Bawonga | [email protected] |
PEER-TO-PEER FILE SHARING
 How to protect yourself when using P2P

0712-925247 | 0700124500
 Install Antivirus
 Symantec Antivirus

 Checkfor operating system and software updates

regularly

 Install Spyware Detection Software

 Microsoft Defender Beta 2
 Spybot
 Adaware
 Lecturer | Kasawuli Bawonga | [email protected] |
A LOOK BACK
 Common Security Terminology

0712-925247 | 0700124500
 Finding sources of technology terminology
 www.webopedia.com
 Password Security
 Remember Iig2cyPe6m
 Web Security
 Remember update, update, update
 Peer-to-Peer File sharing
 Get some Antivirus and some anti-spyware
software