E Security: Security On the Internet

Notes

Study Notes

Internet and Website Security Risks: DoS, Malware, and Intrusion

E-Security: Comprehensive Network and Website Risks

A deep dive into the primary threats facing digital infrastructure: service disruption, malicious software, and unauthorized access.

[Image of a layered network security model]

1. Denial-of-Service (DoS/DDoS) Attacks

A Denial-of-Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. A Distributed Denial-of-Service (DDoS) attack is a sophisticated version using multiple compromised computer systems (a **botnet**) to flood the target.

Mechanism and Types of Attacks

  • Volume-Based Attacks: These overwhelm the bandwidth of the target network or server.
    UDP Flood & ICMP Flood: Sending large volumes of packets using the User Datagram Protocol (UDP) or Internet Control Message Protocol (ICMP) to consume available bandwidth.
  • Protocol Attacks: These consume server resources (like CPU, memory, firewall capacity) by exploiting weaknesses in network protocols.
    SYN Flood: The attacker initiates a TCP handshake (sends a SYN packet) but never completes it (no ACK response), leaving the server's connection table full of half-open connections, preventing legitimate users from connecting.
  • Application Layer Attacks (Layer 7): The most sophisticated, these attacks target specific web application features (like search, login, or database queries) to crash the application logic without consuming vast bandwidth.
    HTTP Flood: Sending a high volume of seemingly legitimate GET or POST requests that require significant server processing time, exhausting the server's application capacity.

Mitigation Strategies for DoS/DDoS

  • Rate Limiting: Limiting the number of requests a server accepts from a single IP address within a specific time window.
  • Blackholing/Filtering: Redirecting malicious traffic into a 'blackhole' where it is dropped, though this may impact legitimate traffic.
  • Content Delivery Networks (CDNs): Utilizing CDN providers (like Cloudflare, Akamai) which have massive distributed networks to absorb and filter malicious traffic far away from the origin server.
  • DDoS Scrubbing Services: Specialized services that analyze incoming traffic, filter out attack packets, and forward only clean, legitimate traffic to the origin server.
  • Load Balancing: Distributing traffic across multiple servers to prevent any single server from becoming overwhelmed.

2. Viruses, Worms, and Malware

Malware (malicious software) is a broad term for any hostile, intrusive, or annoying software. Viruses and worms are specific types of malware known for their replication capabilities.

Types and Propagation

  • Virus: Requires a host program to infect. It replicates by attaching itself to other executable code. It requires user interaction (e.g., running an infected program) to execute.
    Example: A file infector virus attaches to system files and executes when those files are opened.
  • Worm: A standalone program that actively replicates and spreads over a network without requiring a host program or user interaction. Worms exploit security vulnerabilities to automatically transmit themselves across computers.
    Impact: Worms consume network bandwidth and crash systems through overwhelming network traffic.
  • Ransomware: Encrypts the victim's data or locks down their entire system, demanding a ransom (usually in cryptocurrency) for the decryption key.
    Mitigation Key: Regular, offline, and verified backups are the only true defense against ransomware.
  • Trojan Horse: Disguised as legitimate software, but carries a malicious payload (e.g., spyware, keyloggers, or backdoors) that activates once installed. Unlike viruses and worms, Trojans do not typically replicate themselves.
    Botnets: Trojans are often used to secretly enroll victim computers into a botnet used for DDoS attacks or spam campaigns.
  • Spyware and Adware: Designed to track user activity, steal personal information, or display unwanted advertisements, compromising user privacy and system performance.

Mitigation Strategies for Malware

  • Anti-Malware and Antivirus Software: Essential for signature-based detection and heuristic analysis of files.
  • Patch Management: Regularly updating operating systems and applications to close vulnerabilities that worms and exploits target.
  • Email Filtering: Blocking malicious attachments and phishing attempts at the network perimeter.
  • Sandboxing: Executing untrusted code in an isolated environment to prevent it from affecting the host system.

3. Unauthorized Access and Network Intrusion

Unauthorized access occurs when an individual gains entry to a network, system, or application without the necessary privileges. This is often the precursor to data theft, system manipulation, or espionage.

Methods of Intrusion

  • Exploiting Software Vulnerabilities:
    Zero-Day Exploits: Attackers capitalize on previously unknown vulnerabilities for which no patch (fix) exists yet.

    Injection Flaws: Such as SQL Injection (SQLi) or Cross-Site Scripting (XSS), where the attacker inserts malicious code into a web application to manipulate the backend database or user sessions.

  • Brute Force and Credential Stuffing:
    Brute Force: Systematically attempting every possible password combination until the correct one is found.

    Credential Stuffing: Using credentials stolen from one breached service to gain access to a user's account on a different service, relying on password reuse.

  • Network Eavesdropping (Sniffing):
    Mechanism: Intercepting data packets traveling across a network. If the data is not encrypted (e.g., using unsecured HTTP), credentials or sensitive information can be captured.
  • Default or Weak Configurations:
    Vulnerability: Leaving default usernames and passwords on network devices (e.g., routers, firewalls, IoT devices) or not properly segmenting the network, allowing intruders easy lateral movement once inside.

Mitigation Strategies for Unauthorized Access

  • Firewalls and Network Segmentation: Implementing firewalls to block unauthorized traffic and separating the network into segments (e.g., DMZ, Internal, Guest) to limit the damage of a breach.
  • Intrusion Detection/Prevention Systems (IDS/IPS): Monitoring network traffic for suspicious patterns (signatures) or anomalous behavior indicative of an attack and actively blocking the malicious traffic.
  • Strong Authentication: Enforcing complex password policies, regular rotations, and mandatory **Multi-Factor Authentication (MFA)**.
  • Principle of Least Privilege (PoLP): Giving users and applications only the minimum necessary permissions to perform their required tasks, limiting the scope of damage if an account is compromised.
  • Web Application Firewalls (WAF): Protecting web applications from common application-layer attacks (like SQLi and XSS) by inspecting and filtering HTTP traffic.

4. Comprehensive E-Security Framework (Beyond Individual Threats)

Effective E-Security requires a layered, defense-in-depth approach that addresses technical controls, governance, and human factors.

  • Data Encryption:
    Data in Transit: Mandatory use of HTTPS/TLS to encrypt communication between the client and server, mitigating eavesdropping risk.

    Data at Rest: Encrypting databases, files, and backups stored on servers to protect them even if the storage medium is physically stolen.

  • Regular Auditing and Vulnerability Testing:
    Penetration Testing (Pen Testing): Authorized simulated attacks against the system to find exploitable vulnerabilities before malicious hackers do.

    Vulnerability Scanning: Automated tools that scan networks and applications for known security flaws and misconfigurations.

  • Security Policy and Training (The Human Factor):
    User Awareness: Since most attacks start with human error (e.g., falling for a phishing email, using weak passwords), regular, mandatory security training is critical.

    Incident Response Plan: A documented, actionable plan for detecting, containing, eradicating, and recovering from a security breach.

These notes summarize the fundamental threats in electronic security, emphasizing that defense must be continuous, multi-layered, and adaptive to new attack vectors.

Navigation

Digital Signatu... Back to Module Security Standa...