DSS Final: Internet, Security & Ethics

Internetwork

Interconnected networks

Routes & firewalls

The Internet

Network of Networks

(No one governs or owns it)

ARPANET

Advanced Research Projects Agency Network

(Nuclear war myth) first operational packet-switching network and a precursor to the modern Internet.

NSF

National Science Foundation

AUP dropped, commercial traffic allowed

TCP/IP

Transmission Control Protocol/Internet Protocol

IPv4 addresses

A set of standardized rules that allow computers to communicate over a network.

Browsers

software applications used to access, retrieve, and display content from the World Wide Web.

Led to Mosaic & Netscape

(Google Chrome, Firefox, Safari)

HTML & HTTP

Hypertext Markup Language and Hypertext Transfer Protocol

Tags, webpages

URL

Uniform Resource Locator. The unique address of any Web document. (.com, .net, .edu, .org)

DNS

Domain Name System, Universal address translator. "phonebook" of the internet, translating human-readable domain names into IP addresses

website

a collection of related webpages

Search Engine

A database; Organized, Queries, and Spiders/bot

cloud computing

Computing services over Networks

Service virtualization

ASP to XaaS

Saas, IaaS, PaaS, HaaS

he evolution from Application Service Providers (ASPs) to "Everything as a Service" (XaaS)

Web Services & SOA

-Software "objects"

-Build applications

-Scalable (extensible)

-Service-Oriented Architecture

IoT

(Internet of Things) refers to a network of physical objects of things that are embedded with electronics, sensors, software, and network creativity. These physical objects can exchange data with each other

Cookies

Unexecutable text files,

Deposited by servers

Tracks user

Maintains "state" with server

Spyware

designed to secretly monitor and collect information about a user or organization with/without their knowledge or consent

Emails, settings, clickstreams

Relays to 3rd party

Phishing

An attack that sends an email or displays a Web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information

Ransomware

Hijacks data/files for payment

Sometimes a scam

zero-day vulnerability

a security flaw in software or hardware that is unknown to the software vendor or developer and has not yet been patched

Multi-factor authentication

a security process that requires users to provide two or more independent credentials

(Knowledge, Inherent, & Possession)

Knowledge

Something you know

Password, PIN, secret question

Inherent

something you are

Fingerprint, Voice recognition, biometrics

Possession

something you have

Fob, code, QR code, confirmation

Public Key Infrastructure (PKI)

the system for issuing pairs of public and private keys and corresponding digital certificates

Encryption

Symmetric

Asymmetric

Digital signatures

Blockchain

Distributed database

Block = transaction/document/file/contract

Social Engineering

manipulation where attackers trick people into giving up confidential information, access credentials, or performing actions

Golden Rule

Do unto others as you would have them do unto you

Kant's Categorical Imperative

"What kind of world would it be if everyone behaved this way?"

Slippery Slope

A step closer to something undesirable

Utilitarianism

The good of the many

Risk Aversion

Reduce risk/cost

No free Lunch

Assume ownership

Securing Business Practices

- governance, risk and compliance (GRC)

- corporate governance

- IT governance

Governance

[S]tructures and processes... for accountability,transparency, rule of law, [and] stability

Corporate Governance

Policies, regulations, laws to ensure company is run properly

IT Governance

Accountability in IT development & use

Risk

Probability of an unwanted event

Controls

Policies and procedures to mitigate risk or reduce damage (prevent or detect)

Audit

Evaluation of evidence regarding integrityand reliability of a system

Compliance

State of accordance with a set of specifications or legislation

SOX, FIP, COPPA, FERPA, HIPAA, Basel, & GDRP

IT (accounting or systems) Audit

Risk-focused

Promote sound control

Ensure timely resolution of deficiencies

Inform stakeholders of risk-management practices effectiveness