Internet Security- User's Perspective

8/6/2019 Internet Security- User's Perspective

1/65

Cyber Laws ProjectCyber Laws Project

Internet Security:Internet Security:Users PerspectiveUsers Perspective


2/65

Presented To:Presented To:--

Dr. Hitesh KapoorDr. Hitesh Kapoor

Asstt. ProfessorAsstt. Professor

Dept. of Applied SciencesDept. of Applied Sciences

Presented By:Presented By:--

Siddharth BhardwajSiddharth Bhardwaj Surbhi VijhSurbhi Vijh

UE 85094UE 85094 UE 85098UE 85098


3/65

IntroductionIntroduction

InternetInternet SecuritySecurity:: UsersUsers PerspectivePerspective isis aastudystudy onon thethe variousvarious practicespractices andand precautionsprecautionsaa useruser mustmust undertakeundertake toto protectprotect his/herhis/her

computercomputer systemsystem fromfrom thethe viableviable threatsthreats whenwhenconnectedconnected inin aa computercomputer networknetwork (Internet)(Internet)..

TheThe topictopic isis aimedaimed atat understandingunderstanding thethe variousvariousthreatsthreats thatthat areare encounteredencountered onon aa widespreadwidespreadbasisbasis andand thethe variousvarious securitysecurity measuresmeasures thatthatneedneed toto bebe implementedimplemented soso asas toto countercounter themthem..


4/65

Internet SecurityInternet Security

InternetInternet securitysecurity isis aabranchbranch of of computercomputersecuritysecurity specificallyspecifically relatedrelatedtoto thethe InternetInternet.. ItsItsobjectiveobjective isis toto establishestablishrulesrules andand measuresmeasures toto useuseagainstagainst attacksattacks overover thetheInternetInternet.. TheThe InternetInternetrepresentsrepresents anan insecureinsecure

channelchannel forfor exchangingexchanginginformationinformation leadingleading toto aahighhigh riskrisk ofof intrusionintrusion ororfraud,fraud, suchsuch asas phishingphishing..


5/65

Need: Internet SecurityNeed: Internet Security

oo SecuritySecurity notnot aa designdesignconsiderationconsideration

oo ImplementingImplementing changechange isis

difficultdifficultoo OpennessOpenness makesmakes machinesmachines

easyeasy targetstargets

oo IncreasingIncreasing complexitycomplexity

oo RisingRising numbernumber ofof threatsthreats ininthethe formform of of viruses,viruses,trojans,trojans, worms,worms, spamspam etcetc..


6/65

Rising Security IncidentsRising Security Incidents

19901980

High

Low 2000 -from Cisco Systems

TechnicalKnowledgeRequired

Sophisticationof Hacker

Tools


7/65

Internet Security?Internet Security?

KeyloggersKeyloggers


8/65

The Most Common ExcusesThe Most Common Excuses

oo NoNo oneone couldcould possiblypossibly bebe interestedinterestedinin mymy informationinformation

oo AntiAnti--virusvirus softwaresoftware slowsslows downdown mymyprocessorprocessor speedspeed tootoo muchmuch..

oo II don'tdon't useuse antianti--virusvirus softwaresoftwarebecausebecause II nevernever openopen virusesviruses oror ee--mailmail attachmentsattachments fromfrom peoplepeople II don'tdon'tknowknow..

oo SoSo manymany peoplepeople areare onon thethe Internet,Internet,

I'mI'm justjust aa faceface inin thethe crowdcrowd.. NoNo oneonewouldwould pickpick meme outout..

oo I'mI'm busybusy.. II can'tcan't becomebecome aa securitysecurityexpertexpert----II don'tdon't havehave time,time, andand it'sit'snotnot importantimportant enoughenough

OrOr


9/65

Security CountermeasuresSecurity Countermeasures

Three Phase ApproachThree Phase Approach

PROTECTIONPROTECTION

DETECTIONDETECTION

RESPONSERESPONSE


10/65

VirusesViruses

oo AA programprogram thatthat getsgets intointoaa computercomputer systemsystem bybymeansmeans ofof hardwarehardware ororsoftwaresoftware withoutwithout thethe

knowledgeknowledge ofof thethecomputercomputer user,user, andand thenthenattachesattaches itselfitself toto aaprogramprogram filefile..

oo TheThe virusvirus thenthen startsstarts toto

replicatereplicate itselfitself andand dodo thethedamagedamage itit hashas beenbeenprogrammedprogrammed toto dodo..


11/65


12/65


13/65

WormsWorms

oo ComputerComputer WormsWorms areare likelikeaa virusvirus inin thethe factfact thatthat theytheydodo self self replicatereplicatethemselvesthemselves withinwithin youryourcomputercomputer systemsystem..

oo However,However, aa computercomputerwormworm doesdoes notnot havehave totoattachattach itselfitself toto aa programprogram

inin youryour systemsystem likelike aacomputercomputer virusvirus doesdoes ininorderorder toto functionfunction..


14/65

WormsWorms

oo WormsWorms areare aa subsetsubset ofof virusesviruses

oo TheThe differdiffer inin thethe methodmethod ofof attachmentattachment;;

ratherrather thanthan attachingattaching toto aa filefile likelike aa virusvirus aawormworm copiescopies itselfitself acrossacross thethe networknetworkwithoutwithout attachmentattachment..

oo InfectsInfects thethe environmentenvironment ratherrather thanthan specificspecificobjectsobjects


15/65

Trojan HorsesTrojan Horses

An An apparentlyapparently usefulusefulandand innocentinnocent programprogramcontainingcontaining additionaladditionalhiddenhidden codecode whichwhichallowsallows thethe unauthorizedunauthorizedcollection,collection, exploitation,exploitation,falsification,falsification, orordestructiondestruction ofof datadata..


16/65

Installation: Trojan HorsesInstallation: Trojan Horses

oo Secretly installed whenSecretly installed whenan infected executablean infected executableis runis run

oo Much like a virusMuch like a virus

oo Executables typicallyExecutables typicallycome from P2Pcome from P2P

networks ornetworks orunscrupulousunscrupulouswebsiteswebsites


17/65

EffectsEffects

oo Allows remote access:Allows remote access:

oo To spyTo spy

oo To disruptTo disruptoo To relay a malicious connection, so as toTo relay a malicious connection, so as to

disguise the attackers location (spam, hacking)disguise the attackers location (spam, hacking)

oo To access resources (i.e. bandwidth, files)To access resources (i.e. bandwidth, files)

oo To launch aTo launch a DDistributedistributed DDenialenial ooffSServiceervice((DDoS) attackDDoS) attack


18/65

SpywareSpyware

A A generalgeneral termterm forfor aaprogramprogram thatthat surreptitiouslysurreptitiouslymonitorsmonitors youryour actionsactions.. WhileWhiletheythey areare sometimessometimes sinister,sinister,likelike aa remoteremote controlcontrolprogramprogram usedused byby aa hacker,hacker,softwaresoftware companiescompanies havehavebeenbeen knownknown toto useuse SpywareSpyware

toto gathergather datadata aboutaboutcustomerscustomers.. TheThe practicepractice isisgenerallygenerally frownedfrowned uponupon..


19/65

Disadvantages: SpywareDisadvantages: Spyware

oo BrowsingBrowsing profilesprofiles createdcreated forfor usersusers withoutwithout consentconsent

oo UsedUsed forfor targettarget marketingmarketing andand statisticalstatistical analysisanalysis

oo UnableUnable toto removeremove SpywareSpyware programsprograms oror disabledisable themthem

oo IncreasedIncreased numbernumber ofof misleadingmisleading // inappropriateinappropriate poppop--upsups

oo InvasionInvasion ofof useruser privacyprivacy (hidden(hidden fromfrom user)user)

oo OftenOften badlybadly writtenwritten programsprograms corruptcorrupt useruser systemsystem

oo AutomaticallyAutomatically providesprovides unwantedunwanted helpfulhelpful toolstools

oo EstimatedEstimated overover 2020 million+million+ peoplepeople havehave SpywareSpyware onon theirtheirmachinesmachines..


20/65

Spyware DefenceSpyware Defence

User InitiativesUser Initiatives

oo Issue AwarenessIssue Awareness

oo Use Legitimate S/WUse Legitimate S/WSourcesSources

oo Improved Technical AbilityImproved Technical Ability

oo Choice of BrowserChoice of Browser

oo Choice of OSChoice of OSoo Legal action taken againstLegal action taken against

breaches of privacybreaches of privacy

Technical Initiatives...Technical Initiatives...

oo Spyware RemovalSpyware Removal

ProgramsProgramsoo PopPop--up Blockersup Blockers

oo Firewall TechnologyFirewall Technology

oo Disable ActiveX ControlsDisable ActiveX Controls

oo Not SandboxedNot Sandboxedoo EE--Mail FiltersMail Filters

oo Download PatchesDownload Patches


21/65

Similarities / DifferencesSimilarities / Differences

SpywareSpyware Trojan HorsesTrojan Horses

Commercially MotivatedCommercially Motivated MaliciousMalicious

Internet connection requiredInternet connection required Any network connection requiredAny network connection required

Initiates remote connectionInitiates remote connection Receives incoming connectionReceives incoming connection

Purpose: To monitor activityPurpose: To monitor activity Purpose: To control activityPurpose: To control activity

Collects data and displays popCollects data and displays pop--upsups Unauthorized access and controlUnauthorized access and control

LegalLegal IllegalIllegal

Not Detectable with Virus CheckerNot Detectable with Virus Checker Detectable with Virus CheckerDetectable with Virus Checker

Age: Relatively New (< 5 Years)Age: Relatively New (< 5 Years) Age: Relatively Old ( > 20 Years)Age: Relatively Old ( > 20 Years)

Memory Resident ProcessesMemory Resident Processes

Surreptitiously installed without users consent or understandingSurreptitiously installed without users consent or understanding

Creates a security vulnerabilityCreates a security vulnerability


22/65


23/65

Symptoms: MalwareSymptoms: Malware

o Slow down, malfunction,or display repeated errormessages

o Won't shut down or restarto Serve up a lot of pop-up

ads, or display them whenyou're not surfing the web

o Display web pages orprograms you didn't intendto use, or send emails youdidn't write


24/65

KeyloggersKeyloggers

Keystroke logging (oftencalled keylogging) is theaction of tracking (orlogging) the keys struck on

a keyboard, typically in acovert manner so that theperson using the keyboard isunaware that their actionsare being monitored. There

are numerous keyloggingmethods, ranging fromhardware to software-basedapproaches


25/65

Keylogging Includes:Keylogging Includes:

o Clipboard loggingo Screen loggingo Programmatically capturing the text in a control

o The recording of every program/folder/windowopened.o The recording of search engines queries, Instant

Messenger Conversations, FTP Downloads andother internet based activities.

o In some advanced software keyloggers, sound canbe recorded from a user's microphone and videofrom a user's webcam.


26/65

CountermeasuresCountermeasures

o Anti-spywareo Network monitorso Automatic form filler programso One-time passwordso On-screen keyboardso Speech recognitiono Keystroke interference softwareo Handwriting recognition and mouse gestures


27/65

CookiesCookies

oo AA CookieCookie isis aa smallsmall texttext filefile sentsent toto thethe useruser fromfromaa websitewebsite..oo ContainsContains WebsiteWebsite visitedvisited

oo ProvidesProvides clientclient--sideside personalisationpersonalisationoo SupportsSupports easyeasy LoginLoginoo TheThe websitewebsite isis effectivelyeffectively ableable toto rememberremember thethe

useruser andand theirtheir activityactivity onon previousprevious visitsvisits..oo SpywareSpyware companiescompanies workingworking withwith websiteswebsites areare

ableable toto useuse thisthis relativelyrelatively innocentinnocent technologytechnology totodeliverdeliver targetedtargeted REALREAL TIMETIME marketing,marketing, basedbased ononcookiescookies andand profilesprofiles..


28/65


29/65

Taking Precautions withTaking Precautions with

CookiesCookiesoo ToTo increaseincrease youryour levellevel ofof security,security, considerconsider adjustingadjusting

youryour privacyprivacy andand securitysecurity settingssettings toto blockblock oror limitlimit

cookiescookies inin youryour webweb browserbrowser..oo ToTo makemake suresure thatthat otherother sitessites areare notnot collectingcollecting

personalpersonal informationinformation aboutabout youyou withoutwithout youryourknowledge,knowledge, choosechoose toto onlyonly allowallow cookiescookies forfor thethe webwebsitesite youyou areare visitingvisiting;; blockblock oror limitlimit cookiescookies fromfrom aa

thirdthird--partyparty..oo IfIf youyou areare usingusing aa publicpublic computer,computer, youyou shouldshould makemake

suresure thatthat cookiescookies areare disableddisabled toto preventprevent otherotherpeoplepeople fromfrom accessingaccessing oror usingusing youryour personalpersonalinformationinformation..


30/65

AntiAnti--VirusVirus

o Anti-Virus Software isa computer programthat can be used to scanfiles to identify andeliminate computerviruses, worms, trojanhorses and othermalicious software

(malware) from aninfected computer.

o It also protects thecomputer from furthervirus attacks.


31/65

Functions: Antivirus

o Scanning Files

o Removing Infections

o Virus Protectiono Spyware

o Real-Time Scanning

oWebsites

o Email

o Data Mining


32/65

Detecting Computer

Threats

o Most commercial anti-virus software use the

following approaches, with an emphasis onthe virus dictionary approach:

o Virus dictionary approach

o Suspicious behavior approach


33/65

FirewallFirewall

o A system or group of systems that enforces anaccess control policybetween two networks.

oo A firewall is like a castle withA firewall is like a castle witha drawbridgea drawbridgeoo Only one point of accessOnly one point of access

into the networkinto the networkoo This can be good or badThis can be good or bad

oo Can be configured toCan be configured toblock data from certainblock data from certainlocations while allowinglocations while allowingthe relevant andthe relevant andnecessary data through.necessary data through.


34/65

FirewallsFirewalls

oo Basic problemBasic problem many network applications andmany network applications andprotocols have security problems that are fixedprotocols have security problems that are fixedover timeover time

oo Difficult for users to keep up with changes andDifficult for users to keep up with changes andkeep host securekeep host secure

oo SolutionSolution

ooAdministrators limit access to end hosts byAdministrators limit access to end hosts byusing a firewallusing a firewall

ooFirewall is kept upFirewall is kept up--toto--date by administratorsdate by administrators


35/65

Conclusion: FirewallConclusion: Firewall

oo CannotCannot controlcontrol backbackdoordoor traffictraffic

oo CannotCannot fullyfully protectprotectagainstagainst newnew virusesviruses

oo NeedNeed antivirusantivirus ononeacheach hosthost MachineMachine

oo NeedsNeeds toto bebe correctlycorrectlyconfiguredconfigured

oo TheThe securitysecurity policypolicy mustmustbebe enforcedenforced


36/65

PhishingPhishing

oo Sending people eSending people e--mail messages in order tomail messages in order tolure them into divulging sensitive datalure them into divulging sensitive data

oo The data sought is commonly passwordsThe data sought is commonly passwordsand creditand credit--card detailscard details

oo The data is commonly keyed into a webThe data is commonly keyed into a web--

form on a site that purports to be operatedform on a site that purports to be operatedby the trusted identityby the trusted identity


37/65

Example: Phishing SiteExample: Phishing Site


38/65

Good Security HabitsGood Security Habits

oo LockLock youryour computercomputer whenwhen youyou areare awayaway fromfrom itit

oo DisconnectDisconnect youryour computercomputer fromfrom thethe InternetInternet whenwhen youyou aren'taren'tusingusing itit

oo EvaluateEvaluate youryour securitysecurity settingssettings

oo ProtectProtect youryour computercomputer againstagainst powerpower surgessurges andand briefbrief outagesoutages

oo BackBack upup allall ofof youryour datadata

oo UseUse andand maintainmaintain antianti--virusvirus softwaresoftware

oo InstallInstall oror enableenable aa firewallfirewall

oo KeepKeep softwaresoftware upup toto datedate

oo UseUse antianti--spywarespyware toolstools

oo FollowFollow goodgood securitysecurity practicespractices


39/65

Software AnalysisSoftware Analysis


40/65

Awareness about Various ThreatsAwareness about Various Threats


41/65

Antivirus Softwares UsedAntivirus Softwares Used


42/65

Awareness about Security MeasuresAwareness about Security Measures


43/65

AntiAnti--SpywareSpyware


44/65

SpybotSpybot-- Search and DestroySearch and Destroy

oo SpybotSpybot -- SearchSearch && DestroyDestroy detectsdetects andand removesremovesspyware,spyware, aa relativelyrelatively newnew kindkind ofof threatthreat notnot yetyet coveredcovered bybycommoncommon antianti--virusvirus applicationsapplications..

oo SpywareSpyware silentlysilently trackstracks youryour surfingsurfing behaviourbehaviour toto createcreate aa

marketingmarketing profileprofile forfor youyou thatthat isis transmittedtransmitted withoutwithout youryourknowledgeknowledge toto thethe compilerscompilers andand soldsold toto advertisingadvertisingcompaniescompanies..

oo IfIf youyou seesee newnew toolbarstoolbars inin youryour InternetInternet ExplorerExplorer thatthat youyouhaven'thaven't intentionallyintentionally installed,installed, ifif youryour browserbrowser crashescrashesinexplicably,inexplicably, oror ifif youryour homehome pagepage hashas beenbeen "hijacked""hijacked" (or(or

changedchanged withoutwithout youryour knowledge),knowledge), youryour computercomputer isis mostmostprobablyprobably infectedinfected withwith spywarespyware..oo EvenEven ifif youyou don'tdon't seesee thethe symptoms,symptoms, youryour computercomputer maymay

bebe infected,infected, becausebecause moremore andand moremore spywarespyware isis emergingemerging..


45/65

Ease of

Setup/Use5/5

Detection

Effectiveness4.5/5

Removal

Effectiveness4.5/5

System

Performance3.5/5

ScanPerformance

4/5

Support/Docume

ntation4/5

Ratings: SpybotRatings: Spybot


46/65

AntiAnti--MalwareMalware


47/65

Malwarebytes AntiMalwarebytes Anti--MalwareMalware

oo MalwarebytesMalwarebytes AntiAnti--MalwareMalware isis aa surprisinglysurprisingly effectiveeffective freewarefreeware antianti--malwaremalware tooltool.. ItIt cancan detectdetect andand removeremove malwaremalware thatthat eveneven thethe mostmostwellwell knownknown antianti--virusvirus andand antianti--malwaremalware applicationsapplications failfail toto detectdetect..

oo Malwarebytes'Malwarebytes' AntiAnti--MalwareMalware monitorsmonitors everyevery processprocess andand stopsstopsmaliciousmalicious processesprocesses beforebefore theythey eveneven startstart..

ooKey

Key FeaturesFeatures::oo LightLight speedspeed quickquick scanningscanning..oo AbilityAbility toto performperform fullfull scansscans forfor allall drivesdrives..oo DatabaseDatabase updatesupdates releasedreleased dailydaily..oo QuarantineQuarantine toto holdhold threatsthreats andand restorerestore themthem atat youryour convenienceconvenience..oo IgnoreIgnore listlist forfor bothboth thethe scannerscanner andand ProtectionProtection ModuleModule..

oo AA smallsmall listlist ofof extraextra utilitiesutilities toto helphelp removeremove malwaremalware manuallymanually..oo MultiMulti--linguallingual supportsupport..oo WorksWorks togethertogether withwith otherother antianti--malwaremalware utilitiesutilities..oo CommandCommand lineline supportsupport forfor quickquick scanningscanning..oo ContextContext menumenu integrationintegration toto scanscan filesfiles onon demanddemand..


48/65


49/65

FirewallFirewall


50/65

Comodo Internet SecurityComodo Internet Security

oo ComodoComodo firewallfirewall isis uniqueunique inin wayway thatthat itit passespasses allall knownknown leakleakteststests toto ensureensure thethe integrityintegrity ofof datadata enteringentering andand exitingexiting youryoursystemsystem..

oo ComodoComodo hashas putput firewallfirewall throughthrough allall kindskinds ofof sophisticatedsophisticated teststeststoto ensureensure itsits firewallfirewall isis powerfulpowerful enoughenough toto wardward offoff thesethese

attacksattacks withwith defaultdefault settingssettings.. NoNo otherother firewallfirewall hashas hadhad toto workworkthisthis hardhard..oo SecuresSecures againstagainst internalinternal andand externalexternal attacksattacksoo BlocksBlocks internetinternet accessaccess toto maliciousmalicious TrojanTrojan programsprogramsoo SafeguardsSafeguards youryour PersonalPersonal datadata againstagainst thefttheftoo DeliversDelivers totaltotal endend--pointpoint securitysecurity forfor PersonalPersonal ComputersComputers andand

NetworksNetworksoo BecauseBecause ComodoComodo InternetInternet SecuritySecurity isis moremore thanthan aa firewall,firewall, itit hashas

thethe wherewithalwherewithal toto detectdetect andand blockblock viruses,viruses, TrojanTrojan horses,horses,worms,worms, keyloggers,keyloggers, rootkitsrootkits andand otherother malwaremalware inin realreal timetime..


51/65

Ratings: Comodo FirewallRatings: Comodo Firewall

Firewall Features 5/5

AdditionalSecurity Features

5/5

Ease Of Use 4.5/5

Support/Document

ation5/5


52/65

Antivirus


53/65


54/65


55/65

Conclusion: Kaspersky

Pros Attractive easy interface. Excellentresults in independent lab tests.Effective built-in support. Speed fullscan. Bonus system tuning and privacyfeatures. Rescue Disk can scan evensystems that won't boot.

ConsEarned mediocre scores in hands-onmalware removal and blocking tests.Erroneously identification also found.

Bottom LineKaspersky's latest antivirus looks betterthan ever, and independent labs

consistently put it at or near the top. Inthe hands-on tests it scored well belowwhat the labs would suggest, though,and it made a couple of serious faux pasfalse positives.


56/65

Bit Defender Antivirus 2011

o Stops Virus, Malwareand Spyware

o Safeguards YourPrivacy

o Surf Safelyo Play and Work

Seamlessly (GameMode)

o Smart Tipso Automatic or Manual

Updateso Video Library Support 0

20

40

60

80

100

Performance Features Design


57/65

Ratings: Bit Defender

ATTRIBUTE POINTS

Scope Of Protection 4/5

Effectiveness 4/5

Ease of Installation 4/5

Ease of Use 4/5

Features 4/5

Updates, Help & Support 4/5


58/65

Conclusion: Bit Defender

ProsPreinstall scan eases installation. Bestsuite protection against phishing.

Above-average parental control.Local, remote, and advanced backup.PC Tune-up. Effective spam filtering.Configurable UI. Private data

protection. Remote management.Game/laptop/silent mode.

ConsMediocre malware removal andblocking. Parental control's IMmanagement easily evaded. Old-school firewall passes security

decisions to the user.Bottom LineBitDefender doesnt score as well asprevious versions on anti-malwaretests. Still, its performanceoptimization tool and and its phishingprotection is excellent. It's a goodsecurity suite with a full-featured

backup system.


59/65

Miscellaneous


60/65


61/65

Benefits of Isolated Sandbox

o Secure Web Browsing: Running your Webbrowser under the protection of Sandboxie meansthat all malicious software downloaded by thebrowser is trapped in the sandbox and can be

discarded trivially.o Enhanced Privacy: Browsing history, cookies,

and cached temporary files collected while Webbrowsing stay in the sandbox and don't leak intoWindows.

o Secure E-mail: Viruses and other malicioussoftware that might be hiding in your email can'tbreak out of the sandbox and can't infect your realsystem.


62/65

VirusTotal.com

o VirusTotal is a service developed by Hispasec Sistemas thatanalyzes suspicious files and URLs enabling the identification ofviruses, worms, trojans and other kinds of malicious contentdetected by antivirus engines and web analysis toolbars.

o It uses up to 43 different antivirus products

VirusTotal's main characteristics are:

o Free, independent service.

o Runs multiple antivirus engines.o Runs multiple file characterization tools.

o Real time automatic updates of virus signatures.

o Detailed results from each antivirus engine.


63/65


64/65


65/65

Thank YouThank You

Documents

Internet Security- User's Perspective