What is WWW (World Wide Web)?

(a)        WWW or W3 stands for the World Wide Web. The World Wide Web is an  information retrieval system based on a set of inter-linked hypertext documents             residing on HTTP servers all over the world.

            (b)        Hypertext Transfer Protocol (HTTP) is the protocol used on the World Wide Web to transport web pages and the data associated with them. A URL that begins

with httpretrieves a web page specified by the URL. For example, http://www.vispl.com is the World Wide Web address of VISPL.

            (c)        Tim Berners-Lee developed W3 in 1989 for the European Laboratory for   Particle                   Physics (CERN).

(d)       Hypertext words or areas on the screen are expandable, leading to more details about a subject. WWW hypertext documents contain embedded links to information spread throughout the world. As one link is selected and then another and another, a web of interrelated information gets built.

            (e)        The W3 uses Client-Server technology. Web servers distributed throughout the                       Internet, store hypertext documents, which contain links to additional Internet   resources. A             Client program, called a Web browser, downloads Web documents as   well as the codes                  required for accessing any links that appear in the document.

1.         File Transfer Protocol (FTP)              FTP was designed to move files between two computers on a TCP/IP network. IIS supports FTP through Windows Sockets. FTP uses TCP as its transport protocol for all communication and data exchanges between the client and the server. However, IIS communicates with Windows Sockets, and then Windows Sockets interfaces with TCP.

2.         Methods of Communicating on Net                 There are different "types of communication" available to Internet user with Internet account. They are :-

(a)   Electronic Mail (E-mail)

(b)   Newsgroups

(c)   Telnet  

Electronic Mail          It let's you send messages, documents, even voice and video to people, anywhere in the world. Many businesses are finding that E-mail is becoming more important than the Fax for them to stay in contact with their customers.

Newsgroups        They operate as Electronic Message Boards and discussion groups. Although they do not really contain news, newsgroup information on almost any subject.

Telnet          It is an Internet exploration tool that allows your computer to connect to another Network for remote terminal connection. By providing terminal emulation via TCP , it allows a user of one host to log in to a remote host and interact as a normal user there. It is widely used to access databases and explore public access computer systems.

3.         Dial-up Networking

(a)        Dial-up networking is a Win-98 component that allows connecting, to a      network by using modem.

(b)        To Install Dial-Up Networking, follow the steps-

(i)   On your desktop click the Start button; go to Settings and then Control Panel.

    

(ii)   In the Control Panel dialog box, select Add Remove Programs icon.

(aa)     In Add Remove Programs PropertiesDialog Box, choose Windows Setup Tab and then Communications option.

(ab)    Make sure that Dial-Up-Networking option is checked in the Communications box.

(c)   Click Apply to add the Dial-up Component.

4.         World Wide Web      The Internet is a global "Network of Networks". It is a massive collection of Computers that connects millions of Computers, People, Software Programs, Databases and Files

5.         Uses of WWW           Like many Internet tools, the WWW uses Client/Server Architecture Web servers distributed throughout the Internet store Hypertext documents, which contain links to additional Internet resources. A client program, called a Web Browser,  downloading Web documents, as well as the codes required accessing any links that appear in the document.

6.         Advantages of World Wide Web Include

(a)        A link in a Web Document can be used to open other documents.

(b)        Web Pages can contain pictures, buttons and even links to sound files, in addition to text, thus allowing Multimedia applications.

(c)        Sophisticated Web Documents allow the user to interact with the applications        through Dialog Boxes and Forms.

7.       WWW Browsers.

(a)        Web Browsers are Software Packages that display Web page containing Text, Graphics, Audio and Video files and links to various other pages, and makes the connection necessary to follow Hypertext Links.

(b)        The information returned using Browsers can be incorporated document or can be                 saved as files.

(c)        The best browsers have additional features that save time and make it         easier to                navigate and use the resources of the web.

8.       Browsers.

(a)        Graphic Oriented    Graphical browsers display images, as well as text, and offer Hyperlinks to multimedia resources, including sound and video files. For Example- Netscape Navigator , Internet Exp lorer , Mosaic, Eudora.

            (b)        Text-Oriented       Text oriented browsers enables us to follow web            Hypertext               links but do not display non-text web resources. For Example-Linux

9.       Browser plug-Ins.

(a)        Browser is capable of retrieving and displaying information in a variety of text and                  graphic formats. However the Internet’s Web servers may contain a wide      variety of file                   formats that are beyond a browser’s ability to handle. 

            (b)        There are two ways a browser can be modified to handle these diverse file                              formats

(i)   Helper Applications     It works as a distinct application, separate from           the              Browser.

            (ii)   Plug-In Application    Plug-in application actually expands the                                           functionality of the browser software as required to handle a particular file.

Viruses, Trojans, Worms & Types

 Virus 
           

(a)        A Computer virus is a software program designed to function in a manner diametrically opposed to legitimate software.

(b)        It will load and run without a request. To meet the minimum criteria for computer virus design, a program must be executable, be capable of cloning itself and converting other executable objects into viral clones. Hence, it may be a simple DOS batch file.

Types of Virus           There are six types of Computer viruses

                (a)    Boot Sector Infectors (BSI)  
                (b)    Command Processor Infectors (CPI) 
                (c)    General Purpose Infectors (GPI)       
                (d)   Multipurpose Infectors (MPI)
                (e)    File specific Infectors (FSI)   
                (f)    Memory Resident Infectors (MRI).

Boot Sector Infectors            Computer viruses that specialize in altering data in the master boot sector are called BSIs. They are loaded immediately upon system start up, before the command processor loads and of course before any anti-viral program can be loaded 

Command Processor Infectors        CPIs affect the hidden files as well as the command processor the COMMAND.COM file. These viruses have the advantage of examine a large majority of the interaction between the user and the computer.

General Purpose Infectors        GPIs are designed for the broadest range of infections compatibility. They infect any or particular executable files. They adapt well to most executable file formats, moving quickly among files

Multi Purpose Infectors         MPIs are designed to combine some or all the infectious tributes of the BSIs, CPIs and the GPIs. They are a potent, adaptable and deadly combination of computer virus technologies.

File specific Infectors            FSIs target a fixed number and fixed type of files. FSIs are viral cruise missiles, programmed to seek out and destroy the intended target files and property.

Memory Resident Infectors        MRIs could be boot sector or command processor infectors. They are always loaded and active. 

How a Proxy Passes Traffic, Stateful inspection, Interfaces & Address Translation

How a Proxy Passes Traffic.

(a)        Unlike its packet-filtering counterparts, a proxy does not route any traffic. In fact, a properly configured proxy will have all routing functionality disabled. As its name implies, the proxy stands in or speaks for each system on each side of the firewall.

(b)       For an analogy, think of two people speaking through a language interpreter. While it is true these two people are carrying on a conversation, they never actually speak to one another.

(c)        All communication passes through the interpreter before being passed on to the other party. The interpreter might have to clean up some of the language used, or filter out comments or statements that might seem hostile. To see how this relates to network communications, refer to Figures.

(d)      Our internal host wishes to request a Web page from the remote server. It formulates the request and transmits the information to the gateway leading to the remote network, which in this case is the proxy server.

(e)        Stateful inspection of an application is unique for each application. Any non-predicted ports used by an application are validated and allowed through the firewall using stateful inspection. The following applications are inspected.

(f)        Connections are not only applied to an ACL, but are logged into a state table.

(g)        After a connection is established, all session data is compared to state table.

(i)         FTP

(ii)        TFTP

(iii)       RCMD

(iv)       SQLNETe.

(v)        VDOLive

(vi)       RealAudio.

(aa)      Connections are not only applied to an ACL, but are logged into a state table.

(ab)      After a connection is established, all session data is compared          to state table.

  Stateful inspection    

(a)        Some protocols are difficult to allow through a firewall securely using traditional filtering mechanisms. In FTP, for example, the control connection is typically created using a known port, but the data connection is over a random port. To allow an FTP data connection through a firewall without leaving a large number of open ports requires stateful inspection: packets are inspected at the application layer to determine which port the data connection is using. Traffic on that port can then be allowed to pass through the firewall for the duration of the FTP session.

(b)        Transport-level state inspection provides a number of ways to make TCP traffic more secure and more difficult for hackers to intercept. Stateful inspection of TCP consists of verifying the consistency of the TCP header as well as preventing

some well-known TCP attacks.

            (c)        Any non-predicted ports used by an application are validated and allowed             through the firewall using stateful inspection. The applications inspected are : FTP,       TFTP, RCMD, SQLNET, VDO Live and Real Audio.

 Interfaces      

(a)        The Secure IP Services Gateway can have many interfaces. Each tunnel (end user or branch office) is a virtual interface, and all gateways have two or more physical interfaces. Packets can be classified by the interface on which they arrive at the source interface or the interface on which they leave the (the destination interface).

(b)        The rules in a policy can be constructed to either use or ignore this classification. If the rule designates “Any” as an interface, the rule ignores this classification. If the rule designates an interface or group of interfaces, the rule uses this classification.

(c)        The rules in any policy can use the following terms to designate an interface:-

(i)         Any                 –          Any physical interface or tunnel.
(ii)        Trusted            –          Any private physical interface or tunnel.
(iii)       Untrusted        –          Any public physical interface.
(iv)       Tunnel             –          Any tunnel.

 Address Translation            When an IP address is converted from one value to another, it is called address translation. This feature has been implemented in most firewall products and is typically used when you do not wish to let remote systems know the true IP address of your internal systems.

Destination IP                         -           206.121.73.5  
Source port                  -          1058
Destination port          -           80

Address translation  
Source IP                    -           192.168.1.50  
Destination IP             -           206.121.73.5  
Sourceport                   -           1037
Destination port          -           80

Internet Security and Topology Security

1.         Introduction        The problem of security of a computer and the data or information it may contain, has received much publicity since it became apparent that a computer can play a major role in processing and storing secret, private or proprietary information. They can, therefore, possess tremendous capability for effective dissemination, and thus sharing, or useful facts.

2.         Security          It can be considered as to managerial procedures and technological safeguards applied to computer hardware and data to assure against either accidental or deliberate unauthorized access to, and dissemination of any data held in a computer system.

(a)        Security Measures:- These can be clearly divided into two environments.

(b)        Security of large computer centers/automated data processing centres.

                        (ii) Security of personal computer in automated office environment.

3.         Security of Large Computer Centre.

(a)        Risk Factors       Factors disturbing the function of a data centre can be either intentional or unintentional. Unintentional disturbances are caused by the forces of nature, computer failures or other similar factors. Intentional disturbances are deliberately caused by employees, visitors or intruders. The disturbances can be divided into the following categories.

(i)         Interruption of production, data communications etc.

(ii)        Leakage of information to unauthorized persons.

(iii)       Damage to information, equipment, constructions or persons.

(iv)       Stealing of information or equipment.

(b)        The purpose of the security measures is to ensure an undisturbed functions of the data centre by protecting equipment, spaces, information and personnel. To achieve this, the supervision and protection mechanism should :-  

(i)         Prevent disturbances.

(ii)        Detect disturbances at an early stage.

(c)        Prevention of Disturbances.              The prevention of disturbances and damages is important, even if it has only a limited effect on intentional damage done by “professionals”. Some preventive measures are presented below:

(i) Security checks        When new employees are hired, their background and experience should be checked from reliable sources. This should apply to office cleaners, sub-suppliers, service personnel, etc., who often have unlimited access to the computer rooms.

(ii) Job rotation     Through proper job rotation it can be ensured that the same person does not handle a risk-prone duty for too long.

(iii) Supervision of use      Rights of use of a device/eqpt can be limited or controlled by ensuring that terminals, copying machines, etc. are equipped with locks, programs and files can similarly be protected by passwords.

4..        Topology Security.

(a)        Private Circuit Topologies

(i)         Its  use time division to break the two wire pairs into 30 separate channels. Time division is the allotment of available bandwidth based on time increments. This is extremely useful, as a E1 is capable of carrying both voice and data at the same time.

(ii)        There are two common ways to deploy leased lines or E1s. The circuit        constitutes the entire length of the connection between the two organizational        facilities (such as a branch office and a main office).

(iii)       The leased line is used for the connection from each location to its local exchange carrier

(iv)       Connectivity between the two exchange carriers is then provided by           some other technology, like frame relay.

(v)        The first of these two options creates the more secure connection, but at a much higher cost. Using a private circuit for end-to-end connectivity between two geographically separated sites is the best way to insure that your data is not monitored.

(vi)       While it is still possible in sniff one of these circuits, an attacker would       need to gain physical access to some point along its path.

(vii)      The attacker would also need to be able to identify the specific circuit to monitor. Telephone carriers are not known for using attacker-friendly labels like "Bank XYZ's. financial data: monitor here." The second option is simply used to get your signal to the local exchange carrier. From there, your data would travel over a public network, such as frame relay or X.25.

5.         Private Circuit (Information Security).

(a)        According to a recent forester research, a lot of large companies are monitoring their employees’ outgoing e-mail.

(b)        In fact, they are recruiting special staff just for this job. The justification offered to reduce the financial and legal risks associated with outbound e-mail. Someone sitting at mail server can easily read mail without you are knowing about it. Moreover, when you send out e-mail it travels from your mail server and passes through various SMTP servers over the Internet. This means that anybody with access to those servers can read your mail. Your firewall can’t do anything about it because it is only limited to protecting your network’s boundaries. Anything that goes out of it is beyond the firewall’s control.

(c)        There are ways and means of protecting information, most well known process is ‘ENCRYPTION’. The information traveling over all comn chs can be encrypted. Encryption alone, however doesn’t resolve the problem.

(d)       How do you know that the person or website at the other end is indeed the right one and not an imposter?

(e)        Take an online transaction, be it with a bank or an commerce site. How do you know that your transactions are safe? Moreover, how does the bank or e-commerce site knows that you are who claim to be? Both parties must know each others identity in order to transact. Enter Identity management.

(f)        All this may found simple, but the implementation of information security solutions is not. For instance, which encryption algorithm should you use when sending out mail and which one for stored data. Is SSL encryption sufficient for your e-commerce site? What should you check with your ISP when setting up VPN connections between various sites.