Information Systems Security: Internet, Web, Threats, and Defenses

Introduction to the Internet, World Wide Web, and Cyberspace

  • The Internet and its Evolution: Today's Internet is a global network with approximately 5extbillion5 ext{ billion} users, encompassing nearly every government, business, and organization worldwide. What transformed the Internet into a game-changing innovation was the development of mechanisms allowing users to locate and link documents and resources across diverse connected networks.

  • The World Wide Web (WWW): This system, also known as cyberspace or simply the web, defines how documents and resources are related across this global network of computers. It enables a user on one computer to easily access a document on another.

  • Distinguishing Key Terms:

    • Internet: Connects communication networks to one another.

    • World Wide Web (or The Web): The interconnected system of websites, web pages, and digital content residing on these networked computers.

    • Cyberspace: Encompasses all accessible users, networks, web pages, and applications operating within this global electronic environment.

Recent Data Breaches (2014-2020)

  • The number of reported data breaches globally, along with their associated damages to individuals and organizations, has consistently increased, affecting both public and private sectors.

  • Summary of Notable Data Breaches (Table 1-1):

    • Yahoo:

      • December 2016: Disclosed compromise of 1extbillion1 ext{ billion} accounts.

      • October 2017: Revised estimate to 3extbillion3 ext{ billion} breached accounts.

      • Impact: All Yahoo users urged to change passwords and security questions, discouraged from password reuse, and advised to change passwords for other accounts sharing compromised Yahoo credentials.

    • First American Financial Corporation:

      • May 2019: Sensitive personal financial data for approximately 885extmillion885 ext{ million} users leaked, including transactions dating back to February 2003.

      • Impact: Customers faced, and continue to face, a heightened risk of identity theft.

    • Verifications.io:

      • February 2019: 763extmillion763 ext{ million} unique user email addresses from their validation service were leaked, along with names, telephone numbers, IP addresses, birth dates, and gender.

      • Impact: Customers were, and remain, exposed to an elevated risk of identity theft.

    • Marriott-Starwood Hotels:

      • 2014: Starwood Hotels and Resorts information system was compromised, but the breach remained undetected until 2018. Hackers collected customer data for four years.

      • Impact: Estimated 500extmillion500 ext{ million} guests had personal information stolen, including passport details (for as many as 100extmillion100 ext{ million} customers), and encrypted payment card numbers. After Marriott International acquired Starwood, they faced a massive loss of customer confidence and invested significantly to rebuild trust in their privacy and security policies.

    • Twitter:

      • May 2018: A software bug resulted in user passwords being stored in unencrypted log files, making them accessible to hackers.

      • Impact: Twitter recommended all 300extmillion300 ext{ million} users change passwords but did not disclose the number of affected accounts. Password reuse risk: disclosure on one site could compromise accounts on multiple platforms. Even with good password practices, social media breaches can expose personal information for further attacks, including identity theft.

    • FireEye:

      • December 2020: The security firm announced its proprietary penetration testing tools, used for assessing client data security, were stolen.

      • Impact: FireEye warned that its tools could be maliciously used to hack into other companies.

  • The Dark Side of Cyberspace: Connecting to cyberspace inherently exposes individuals and organizations to