Summary
This course introduces fundamental cybersecurity concepts, emphasizing its relevance to everyone. It defines cybersecurity as protecting against computer-based attacks and highlights that no system is entirely secure. The course delves into the human element of cybercrime, explaining how attackers often exploit user behavior. It breaks down computer systems into layers (user, hardware, OS, applications) and explains their interactions. The curriculum covers internet infrastructure, protocols (IP, HTTP, SMTP), domain names (DNS), and the structure of IP addresses (public/private, static/dynamic). Key topics include password security, various malware types (viruses, worms, Trojans, bots) and their functions (adware, ransomware, botnets), common malware sources (downloads, email attachments, drive-by downloads), defense layers (backups, firewalls, patches, antivirus, education), safe web browsing practices (HTTPS, cookies, history management, file handling), online shopping security, wireless network security (Wi-Fi threats, router administration), social media privacy and security, and interpersonal communication issues online (anonymity, context, privacy, everlasting information, credibility).
Key Insights
Running applications can potentially access any part of the computer system.
Since applications run through the operating system, they can potentially access any file or hardware the OS can. This capability, while necessary for functionality, means malicious applications could misbehave, like keyloggers recording keystrokes.
Private IP addresses allow reuse within local networks, distinct from public IPs.
Routers create private networks using IP addresses that can be reused across different homes or businesses. These private IPs are distinct from the single public IP address assigned by an ISP, functioning like apartment numbers within a unique building address.
Hash functions irreversibly convert passwords into unique hash values for secure storage.
Hash functions convert passwords into unique, fixed-length 'hash values' that look nothing like the original password. This irreversible process prevents direct password recovery even if the hashed data is stolen.
Strong, long passwords significantly increase resistance to brute force attacks.
Brute force attacks try every possible password combination. Strong, long passwords with varied character types dramatically increase the time and computational power needed to crack them, making them much harder to guess.
Rank accounts by importance (tiers) to manage password complexity and change frequency.
Tier 1 accounts (high stake, e.g., banking) need strong, unique passwords changed every six months. Tier 2 (medium stake, e.g., social media) need strong, unique passwords changed annually. Tier 3 (low stake) can reuse strong passwords.
User education empowers individuals to actively participate in their own cybersecurity.
Understanding cybersecurity principles, recognizing attacker tactics, and staying informed about new threats transforms users from passive victims into active participants capable of making informed security decisions.
HTML allows web pages to display local or remote images and external content.
HTML code allows web pages to embed images and other content. 'Local' images are uploaded with the page; 'remote' images are hosted elsewhere. This distinction is vital for identifying potentially deceptive pages.
Hyperlinks in HTML can be programmed to lead to different destinations than their displayed text suggests.
The displayed text of a hyperlink (what the user sees) can be intentionally misleading, directing the user to a different URL than indicated. Hovering over a link reveals its true destination, a key security check.
Compromise of confidentiality, integrity, and availability (CIA model) in the Matt Honan hack.
In the Matt Honan hacking incident, hackers compromised the confidentiality of his information by accessing private accounts, compromised integrity by deleting files and posting false messages, and compromised availability by locking him out of his accounts and permanently deleting data.
Exploits can be carried out using readily available tools and personal information.
Matt Honan's hack was executed without special attack code, using only a web browser, telephone, and publicly available personal information to trick customer service representatives into resetting account passwords.
Linking online accounts creates vulnerabilities that can lead to cascading breaches.
Matt Honan's attack was facilitated by linking multiple online accounts, allowing access to one account to grant access to others. He admitted that taking care of vulnerabilities under his control could have prevented the attack.
Reducing vulnerabilities, threats, or impact lowers overall security risk.
Security risks can be lowered by reducing vulnerability (e.g., enabling two-factor authentication), reducing threat (e.g., being a less appealing target), or reducing potential impact (e.g., backing up data).
Computer systems consist of four interacting layers: User, Hardware, Operating System, and Applications.
A computer system can be understood through four layers: the User (you), the Hardware (physical parts), the Operating System (software coordinating everything), and the Applications (programs for specific tasks). These layers interact to perform computing functions.
Hardware components include the motherboard, CPU, RAM, storage drives, and input/output cards.
Key hardware components are the motherboard (connects all parts), CPU (processes information), RAM (working memory), storage drives (hard drive, CD/DVD for long-term storage), and input/output cards (like Ethernet, graphics, sound cards).
RAM is volatile working memory, while storage is persistent data storage.
RAM (Random Access Memory) is the computer's immediate working memory, providing content for the CPU. Storage, like hard drives or CDs/DVDs, holds data and programs persistently. Information must be loaded from storage into RAM for the CPU to process it efficiently.
Operating systems coordinate interactions between users, hardware, and applications.
The Operating System (e.g., Windows, macOS, Linux) manages the computer's resources, displays files, executes user commands to run programs, and coordinates hardware interactions. Almost all user interaction is mediated through the OS.
Applications are programs designed for specific user tasks.
Applications (apps) are programs that perform specific tasks for users, such as web browsers, calculators, or media players. They are stored on the hard drive and launched via the operating system.
The boot process loads the OS into RAM via BIOS and boot code.
When a computer powers on, the BIOS (Basic Input-Output System) on the motherboard helps the CPU find and load boot code from storage (usually the hard disk) into RAM. This boot code then instructs the computer to load the operating system into RAM for execution.
The internet is a network of interconnected computer networks.
The internet is a vast 'network of networks' (internetworking) created by connecting multiple computer networks together, allowing large-scale data sharing across organizations and geographically dispersed users.
Internet Service Providers (ISPs) manage the physical internet infrastructure.
Organizations known as Internet Service Providers (ISPs), primarily private companies or government agencies, own and maintain the physical networking cables and devices that facilitate internet connectivity.
Communication protocols (like IP) are essential for computers to interact.
Computers need precise communication rules, called protocols, to interact unambiguously. The primary protocol for internetworking is Internet Protocol (IP), which requires every connected device to have a unique IP address.
The internet is hierarchically structured from backbone ISPs down to local providers.
The internet's structure is a hierarchy of Internet Service Providers (ISPs). Backbone ISPs handle the most traffic via high-capacity cables, connected to medium-sized ISPs, which in turn connect to smaller local ISPs that serve residential users.
IP addresses are unique numerical identifiers for devices on the internet.
Every device connected to the internet has a unique IP address, formatted as four sets of numbers (0-255) separated by periods. These addresses are crucial for routing data requests and delivery.
Dynamic IP addresses offer flexibility by leasing addresses temporarily.
Dynamic IP addresses are assigned temporarily by a DHCP server and can change over time. This allows many devices to share a limited pool of IP addresses, making it flexible for networks with many users who don't connect simultaneously.
Domain Name Service (DNS) translates human-readable domain names into IP addresses.
The Domain Name Service (DNS) translates user-friendly domain names (like www.example.com) into numerical IP addresses that computers use to locate servers on the internet, involving a hierarchy of DNS servers.
Routers use route tables to direct information packets across networks.
Routers use internally stored 'route tables' to determine the 'next hop' for information packets based on their destination IP address, enabling efficient data flow across interconnected networks.
Web pages link to other pages, creating a 'web' of interconnected content.
Web pages, stored on servers, can link to other web pages, creating an interconnected 'web' of content. Users can navigate between pages stored on different servers globally almost instantly due to efficient networking.
Passwords are the primary method for proving identity digitally.
Passwords are the preferred means of proving identity online because they are simpler and more convenient than biometric methods (retina scans, DNA) or physical IDs. They allow services to check user identity against stored credentials.
Prime factorization is computationally easier forwards than backwards, illustrating hash irreversibility.
Multiplying two prime numbers together is much easier and faster than finding the prime factors of their product. This asymmetry, like the one-way nature of hash functions, demonstrates why reversing a hash is computationally infeasible.
Keyloggers (hardware or software) record keystrokes to capture passwords.
Keyloggers, either physical devices plugged into keyboards or invisible software, record every keystroke, capturing passwords and other sensitive data typed by the user. Avoiding private account logins on public or untrusted computers is advised.
Phishing attempts to trick users into submitting credentials via fake websites.
Phishing scams use deceptive emails or messages, often creating urgency, to lure users to fake login pages where they voluntarily submit sensitive information like usernames and passwords.
Social engineering manipulates users into revealing passwords.
Social engineering involves subtle manipulation, such as impersonating IT professionals via phone calls or emails, to trick users into disclosing passwords. It preys on trust and authority.
User disclosure and carelessness are significant password threats.
Sharing passwords, writing them down insecurely (sticky notes, unencrypted files), or emailing them directly exposes them, regardless of password strength. Maintaining control over password sharing is crucial.
Wireless sniffing intercepts unencrypted data transmitted over Wi-Fi networks.
On unsecured wireless networks, cybercriminals can intercept data transmissions ('sniffing') between devices and routers, potentially capturing login credentials or emails. Using encrypted networks (like HTTPS or VPNs) is key protection.
Unencrypted password files pose a severe risk if breached.
If a company stores passwords in plain text (unencrypted), a data breach can immediately expose millions of usernames and passwords, highlighting the critical need for companies to encrypt sensitive data.
Password management software and browser features offer convenience but require master password security.
Password managers and browser features can remember and auto-fill passwords, reducing typing and vulnerability to keyloggers. However, the master password for these tools becomes a single point of failure and must be highly secured.
Spam is unsolicited advertising, while phishing scams aim to steal sensitive information.
Spam is typically harmless junk mail. Phishing scams, however, impersonate legitimate entities via email to trick recipients into revealing usernames, passwords, or financial data, often by directing them to fake websites.
Email spoofing fakes the sender's address, making it hard to verify legitimacy.
Spoofing involves faking the return address on an email. While email systems don't require accurate return addresses for delivery, examining email headers is crucial to detect spoofed messages.
Malicious email attachments can deliver malware disguised as legitimate files.
Cybercriminals use email attachments (e.g., disguised executable files) to deliver malware. Curiosity or social engineering tactics often encourage users to open these dangerous attachments.
CC and BCC fields manage recipients with differing levels of visibility.
Carbon Copy (CC) lists recipients visible to all. Blind Carbon Copy (BCC) lists recipients hidden from all others, useful for maintaining privacy in mass communications like surprise party invitations.
Eavesdropping threats include physical observation and wireless network sniffing.
Eavesdropping on email traffic includes direct observation (shoulder surfing) and wireless sniffing (intercepting radio signals), which can expose unencrypted emails and login credentials.
Email headers contain routing information and message details (MIME).
Email headers, attached during transit, record the path the email took through MTAs and include MIME information detailing content types (text, images, attachments), which is essential for understanding email structure.
Email addresses specify the recipient username and the receiving message transfer agent (mail server).
An email address like 'bob@dougj.net' directs the email to the user 'bob' at the mail server identified as 'dougj.net'.
Email systems involve user agents, message transfer agents (MTAs), and protocols like SMTP.
Emails are composed in user agents (applications like Outlook or Gmail), sent via MTAs using SMTP (Simple Mail Transfer Protocol) across the internet, and stored until accessed by the recipient's user agent.
Malware is software designed to harm users or steal information.
Malware is a portmanteau of 'malicious' and 'software', referring to programs intended to harm computer users, cause irritation, or steal information.
Viruses attach to host files and require user action or interaction to spread.
A computer virus is an unwanted program that attaches itself to a host file. It copies itself, but requires action like sharing infected files (via USB, email) to spread to new hosts.
Worms are self-sufficient programs that spread autonomously across networks.
Unlike viruses, worms are independent programs that can spread themselves across networks without needing a host file or direct user interaction, often targeting network resources to slow them down.
Trojan horses disguise malware as legitimate, enticing files to trick users into downloading them.
Trojan horses appear as valuable downloads (games, software) but contain hidden malware. Users voluntarily download them, similar to the mythological Trojan Horse. They don't necessarily spread like worms.
Bots (robots) automate malicious user-like functions, often controlled remotely.
Bots are malicious programs that automate tasks typically done by users (sending emails, browsing sites). They can run undetected and receive commands from a 'bot master', potentially forming botnets.
Malware can overwhelm system resources like bandwidth, storage, or processing power.
Certain malware, particularly worms, can consume excessive network bandwidth or system resources (computing power, memory), rendering the system sluggish or useless until the malware is removed.
Malicious adware displays unwanted, offensive, or deceptive advertisements.
Malicious adware, installed without consent, displays unwanted pop-ups, toolbars, or offensive ads, often directing users to malicious websites or facilitating further infections.
Spyware secretly monitors user activity, including keystrokes and browsing habits.
Spyware collects information about user activity, such as keystrokes (keylogging) or browsing habits, typically remaining hidden to send data to third parties.
Ransomware encrypts files or locks systems, demanding payment for their return.
Ransomware encrypts user files or locks the system, displaying a message demanding payment (a ransom) for decryption or access. It may be a bluff or genuinely encrypt data, but paying is not recommended.
Backdoors provide secret access points for cybercriminals to update or install more malware.
Malware can create secret connections ('backdoors') allowing cybercriminals to remotely update the malware, install additional malicious software, or gain further control over the infected system.
Botnets are networks of compromised computers controlled by a botmaster.
Botnets are large networks of computers infected with bots, controlled remotely by a 'botmaster'. They are used for large-scale attacks like crashing websites (DDoS) or sending spam.
Removable media like USB drives can carry boot sector viruses.
Historically, floppy disks and now USB flash drives can carry boot sector viruses. Leaving infected USB drives in public places is a tactic to infect users who try to return them.
Documents and executables can contain viruses, requiring user interaction to activate.
Files like word processor documents or PDF files can harbor viruses. These viruses only activate if the user opens the infected file, highlighting the need for caution with shared files.
Internet downloads are a common source of Trojan horses.
Trojan horses often originate from internet downloads, where malware is disguised as legitimate files (like free games). Downloading from untrusted sources or clicking suspicious offers increases risk.
Email attachments are frequently used for social engineering malware delivery.
Malicious actors attach malware-infected files to emails, often using social engineering tactics (e.g., fake invoices, tempting file names like 'loveletter') to trick recipients into opening them.
Drive-by downloads infect computers simply by visiting a malicious website.
Visiting a compromised website can trigger the automatic download and installation of malware without user interaction, known as a drive-by download. Avoiding suspicious links is crucial.
Pop-ups can lead users to malicious sites or trick them into downloading malware (Scareware).
Pop-up ads can redirect users to malicious sites with drive-by downloads or prompt downloads of malware. 'Scareware' pop-ups mimic security warnings to frighten users into installing malicious software.
Malicious advertisements can link to phishing sites or trigger malware downloads.
Advertisements purchased on legitimate sites can be malicious, leading users to phishing sites or initiating malware downloads upon clicking. Ad blockers and cautious clicking are advised.
Backing up data provides a recovery option if systems are compromised.
Regularly backing up important files to external media (CDs, USBs, external drives) or cloud storage ensures data can be recovered even if the primary system is infected with malware.
Firewalls act as a barrier between a computer/network and the internet, screening traffic.
Firewalls (hardware or software) monitor and control incoming and outgoing network traffic, blocking unauthorized or unrequested connections from potentially malicious sources while allowing legitimate traffic.
Installing software patches covers known security weaknesses exploited by malware.
Software developers release patches (updates) to fix security vulnerabilities. Regularly installing these patches is crucial to prevent malware from exploiting known weaknesses in the software.
Antivirus software detects, blocks, and sometimes removes malware.
Antivirus software acts like a guard dog, identifying known malware by its code, alerting users, blocking attacks, and potentially removing infections. Keeping it updated is vital for detecting new threats.
Web browsers use HTML, HTTP, and plugins to display web content.
Web browsers (like Firefox, Chrome) interpret HTML code to display web pages, use HTTP for communication with web servers, and employ plugins (PDF viewers, Flash) and internal executables to handle diverse content.
Browser cache speeds up page loading by storing previously accessed data.
A browser's cache stores parts of frequently accessed web pages locally, allowing them to load faster on subsequent visits by reducing the need to download all data again from the web server.
Web browser settings control how files are handled to balance security and convenience.
Users can configure browser settings to automatically open specific file types or to prompt for permission first. Manually handling files offers greater security, while automatic processing is more convenient.
Configure browser file handling to prompt for permission for better security.
Manually selecting how the browser handles files (instead of automatic execution) adds a security layer, allowing users to screen potentially malicious downloads or embedded content.
Cookies enable website features but tracking cookies raise privacy concerns.
Cookies enhance user experience (remembering logins, cart items) but 'tracking cookies' can monitor browsing activity across sites for targeted advertising, raising privacy issues.
HTTPS encrypts traffic, protecting data from eavesdropping, especially sensitive information.
HTTPS (Hypertext Transfer Protocol Secure) encrypts communication between a browser and website, protecting data like login credentials from being intercepted on unsecure networks. Always look for the padlock icon.
Browser history stores visited sites, posing a privacy risk if not managed.
Web browser history logs all visited sites. This can be a privacy risk, especially on public computers. Clearing history, managing cookies, or using private browsing modes help mitigate this.
Employ a defense-in-depth strategy (backups, firewall, patches, antivirus, education) for safe online shopping.
Safe online shopping requires a multi-layered defense strategy, including data backups, firewalls, updated software, antivirus protection, and user education to mitigate malware risks.
Refrain from shopping on unsecured wireless networks due to sniffing risks.
Unsecured wireless networks allow for data interception ('sniffing'). Sensitive financial information transmitted over these networks can be easily captured by cybercriminals.
Phishing emails and websites attempt to steal login and financial details for online retailers.
Phishing scams often involve fake emails or counterfeit retail websites designed to trick users into divulging login credentials or payment information for online stores.
Use link scanners (e.g., Web of Trust) to assess the reputation of hyperlinks.
Link scanners provide reputation ratings (often color-coded) for websites linked in search results or emails, helping users avoid potentially malicious or untrustworthy sites.
Use credit cards over debit cards for online purchases due to better fraud protection laws.
In the US, credit cards offer stronger legal protections against fraud ($50 liability limit regardless of reporting time after initial discovery) compared to debit cards, making them a safer choice for online transactions.
Wi-Fi networks transmit data via radio waves vulnerable to interception.
Wi-Fi transmissions between devices and routers use radio waves that radiate outwards and can be intercepted by anyone within range. Cellular networks use different, generally more secure, technologies.
SSID (network name) broadcasts availability, but can be hidden for added security.
SSIDs are router names broadcast to indicate network availability. Disabling SSID broadcast makes it harder for attackers to even detect a Wi-Fi network.
Wireless sniffing intercepts unencrypted Wi-Fi traffic.
Sniffing involves using software/hardware to intercept and read unencrypted radio wave transmissions on a Wi-Fi network. Encryption (WPA2, HTTPS, VPNs) is the primary defense.
Rogue routers are illegitimate devices set up to steal user data.
Attackers set up rogue routers (e.g., 'Free Airport WiFi') to trick users into connecting, then sniff traffic or charge fees while stealing credentials.
Evil twin routers mimic legitimate network names to trick devices into connecting.
Evil twin routers use the same name (SSID) as legitimate networks (e.g., 'University Wi-Fi'). Devices configured to auto-connect may link to the attacker's router, enabling sniffing.
Unauthorized connections (piggybacking) exploit unsecured home networks.
Allowing unauthorized access to home Wi-Fi (piggybacking) can slow connections, allow router setting changes, enable sniffing, and potentially lead to legal issues if the unauthorized user commits cybercrimes traced to your network.
Using public Wi-Fi for sensitive activities risks traffic interception and malicious network access.
Public Wi-Fi can be insecure due to sniffing, rogue routers, or evil twins. Refrain from private business (banking, shopping) on public networks, use HTTPS, obscure your screen, and consider a VPN.
VPNs create encrypted tunnels for secure internet access, especially on public networks.
A Virtual Private Network (VPN) encrypts all internet traffic between a device and a private network (like a corporate or home network), providing a secure channel even over insecure public Wi-Fi.
Strong router passwords and encryption (WPA2) are essential for home network security.
Changing default router passwords and enabling strong encryption like WPA2 prevents unauthorized access and protects wireless signals from being easily intercepted and read.
Router firewalls add an extra layer of protection against unauthorized network access.
Enabling the router's built-in firewall complements computer firewalls, providing an additional defense against unwanted network traffic.
MAC address filtering allows only approved devices to connect to the network.
MAC address filtering restricts network access to a predefined list of devices, requiring each device's unique MAC address to be registered with the router.
Turning off the router when not in use eliminates connectivity risks.
Disabling the router when not in use prevents any remote attacks or unauthorized usage and also saves electricity.
Privacy is control over who knows what information about you and when.
Privacy is defined as having control over who knows information about you, what specific information they know, and when they gain access to it. Social media inherently involves a trade-off in privacy.
Credibility online depends on verifiable information and transparency.
Establishing credibility online requires transparency and verifiable information. Anonymity and lack of context can make it difficult to assess the trustworthiness of online sources or individuals.
Sections
Introduction to Cybersecurity
Define cybersecurity as protecting oneself and others from computer-based attacks.
Cybersecurity is defined as protecting yourself and others from attacks that are carried out primarily with computers. Because the majority of computer-based attacks target information, cybersecurity is often used interchangeably with information security.
Every computer has vulnerabilities, making security study relevant for all users.
No single computer is secure; all systems, including Wi-Fi networks, servers, banks, retailers, and personal devices, have security vulnerabilities, whether known or unknown. This pervasive insecurity underscores the importance of studying cybersecurity for everyone.
Increasing one's security reduces their attractiveness as a target for cybercriminals.
Users can increase their security, making them less of a target. Cybercriminals, like bicycle thieves choosing between a locked and unlocked bike, prefer less secure systems. Covering more weaknesses lowers the probability of a security breach.
System popularity, not inherent features, influences attack focus.
Mac and Linux machines are not inherently more secure than Windows; their lower popularity makes them less targeted by cybercriminals due to economic incentives. If market share shifted, attack focus would follow.
Cybercriminals exploit user behavior more than computer systems.
Most cybercriminals are con artists who exploit user behaviors and naiveté, rather than demonstrating exceptional technical skills. They often follow simple instructions, and their success relies on users' lack of understanding of cybercriminal tactics.
Deeper understanding of cybersecurity empowers users beyond simple dos and don'ts.
A deeper understanding of cybersecurity principles, how computers and the internet work, and how cybercriminals think, enables users to better recognize and avoid attacks, and to teach themselves about new security problems.
Cybersecurity is presented as a complex, engaging strategy game.
Cybersecurity can be viewed as a complex strategy game involving various players like users, professionals, hackers, corporations, and nation-states. Understanding this dynamic environment is crucial as everyone is already a participant.
Cybersecurity Terminology and Case Studies
Compromise of confidentiality, integrity, and availability (CIA model) in the Matt Honan hack.
In the Matt Honan hacking incident, hackers compromised the confidentiality of his information by accessing private accounts, compromised integrity by deleting files and posting false messages, and compromised availability by locking him out of his accounts and permanently deleting data.
Exploits can be carried out using readily available tools and personal information.
Matt Honan's hack was executed without special attack code, using only a web browser, telephone, and publicly available personal information to trick customer service representatives into resetting account passwords.
Linking online accounts creates vulnerabilities that can lead to cascading breaches.
Matt Honan's attack was facilitated by linking multiple online accounts, allowing access to one account to grant access to others. He admitted that taking care of vulnerabilities under his control could have prevented the attack.
Risk is the combined measure of vulnerabilities, threats, and potential impact.
Risk in cybersecurity is defined as the combined measure of vulnerabilities (weak points), threats (likelihood of attack), and impact (consequences of an attack) for a given system.
Reducing vulnerabilities, threats, or impact lowers overall security risk.
Security risks can be lowered by reducing vulnerability (e.g., enabling two-factor authentication), reducing threat (e.g., being a less appealing target), or reducing potential impact (e.g., backing up data).
Stuxnet's specific targeting and complexity suggest nation-state involvement.
The Stuxnet computer worm, designed to attack a specific uranium enrichment facility in Iran by accelerating centrifuges and displaying false data, exhibited remarkable specificity and complex code, leading to speculation of nation-state development (e.g., US or Israel).
A Zero-Day exploit targets vulnerabilities unknown to software developers.
Stuxnet likely was a zero-day exploit, meaning the attackers found and utilized a vulnerability before it was known to anyone else, contributing to its potential effectiveness.
Demystifying Computers
Computer systems consist of four interacting layers: User, Hardware, Operating System, and Applications.
A computer system can be understood through four layers: the User (you), the Hardware (physical parts), the Operating System (software coordinating everything), and the Applications (programs for specific tasks). These layers interact to perform computing functions.
Hardware components include the motherboard, CPU, RAM, storage drives, and input/output cards.
Key hardware components are the motherboard (connects all parts), CPU (processes information), RAM (working memory), storage drives (hard drive, CD/DVD for long-term storage), and input/output cards (like Ethernet, graphics, sound cards).
RAM is volatile working memory, while storage is persistent data storage.
RAM (Random Access Memory) is the computer's immediate working memory, providing content for the CPU. Storage, like hard drives or CDs/DVDs, holds data and programs persistently. Information must be loaded from storage into RAM for the CPU to process it efficiently.
Operating systems coordinate interactions between users, hardware, and applications.
The Operating System (e.g., Windows, macOS, Linux) manages the computer's resources, displays files, executes user commands to run programs, and coordinates hardware interactions. Almost all user interaction is mediated through the OS.
Applications are programs designed for specific user tasks.
Applications (apps) are programs that perform specific tasks for users, such as web browsers, calculators, or media players. They are stored on the hard drive and launched via the operating system.
The boot process loads the OS into RAM via BIOS and boot code.
When a computer powers on, the BIOS (Basic Input-Output System) on the motherboard helps the CPU find and load boot code from storage (usually the hard disk) into RAM. This boot code then instructs the computer to load the operating system into RAM for execution.
Running applications can potentially access any part of the computer system.
Since applications run through the operating system, they can potentially access any file or hardware the OS can. This capability, while necessary for functionality, means malicious applications could misbehave, like keyloggers recording keystrokes.
Demystifying the Internet
The internet is a network of interconnected computer networks.
The internet is a vast 'network of networks' (internetworking) created by connecting multiple computer networks together, allowing large-scale data sharing across organizations and geographically dispersed users.
Internet Service Providers (ISPs) manage the physical internet infrastructure.
Organizations known as Internet Service Providers (ISPs), primarily private companies or government agencies, own and maintain the physical networking cables and devices that facilitate internet connectivity.
Communication protocols (like IP) are essential for computers to interact.
Computers need precise communication rules, called protocols, to interact unambiguously. The primary protocol for internetworking is Internet Protocol (IP), which requires every connected device to have a unique IP address.
The internet is hierarchically structured from backbone ISPs down to local providers.
The internet's structure is a hierarchy of Internet Service Providers (ISPs). Backbone ISPs handle the most traffic via high-capacity cables, connected to medium-sized ISPs, which in turn connect to smaller local ISPs that serve residential users.
IP addresses are unique numerical identifiers for devices on the internet.
Every device connected to the internet has a unique IP address, formatted as four sets of numbers (0-255) separated by periods. These addresses are crucial for routing data requests and delivery.
Dynamic IP addresses offer flexibility by leasing addresses temporarily.
Dynamic IP addresses are assigned temporarily by a DHCP server and can change over time. This allows many devices to share a limited pool of IP addresses, making it flexible for networks with many users who don't connect simultaneously.
Private IP addresses allow reuse within local networks, distinct from public IPs.
Routers create private networks using IP addresses that can be reused across different homes or businesses. These private IPs are distinct from the single public IP address assigned by an ISP, functioning like apartment numbers within a unique building address.
Domain Name Service (DNS) translates human-readable domain names into IP addresses.
The Domain Name Service (DNS) translates user-friendly domain names (like www.example.com) into numerical IP addresses that computers use to locate servers on the internet, involving a hierarchy of DNS servers.
Routers use route tables to direct information packets across networks.
Routers use internally stored 'route tables' to determine the 'next hop' for information packets based on their destination IP address, enabling efficient data flow across interconnected networks.
Web pages link to other pages, creating a 'web' of interconnected content.
Web pages, stored on servers, can link to other web pages, creating an interconnected 'web' of content. Users can navigate between pages stored on different servers globally almost instantly due to efficient networking.
Passwords and Hash Functions
Passwords are the primary method for proving identity digitally.
Passwords are the preferred means of proving identity online because they are simpler and more convenient than biometric methods (retina scans, DNA) or physical IDs. They allow services to check user identity against stored credentials.
Hash functions irreversibly convert passwords into unique hash values for secure storage.
Hash functions convert passwords into unique, fixed-length 'hash values' that look nothing like the original password. This irreversible process prevents direct password recovery even if the hashed data is stolen.
Prime factorization is computationally easier forwards than backwards, illustrating hash irreversibility.
Multiplying two prime numbers together is much easier and faster than finding the prime factors of their product. This asymmetry, like the one-way nature of hash functions, demonstrates why reversing a hash is computationally infeasible.
Common Password Threats
User disclosure and carelessness are significant password threats.
Sharing passwords, writing them down insecurely (sticky notes, unencrypted files), or emailing them directly exposes them, regardless of password strength. Maintaining control over password sharing is crucial.
Social engineering manipulates users into revealing passwords.
Social engineering involves subtle manipulation, such as impersonating IT professionals via phone calls or emails, to trick users into disclosing passwords. It preys on trust and authority.
Phishing attempts to trick users into submitting credentials via fake websites.
Phishing scams use deceptive emails or messages, often creating urgency, to lure users to fake login pages where they voluntarily submit sensitive information like usernames and passwords.
Keyloggers (hardware or software) record keystrokes to capture passwords.
Keyloggers, either physical devices plugged into keyboards or invisible software, record every keystroke, capturing passwords and other sensitive data typed by the user. Avoiding private account logins on public or untrusted computers is advised.
Wireless sniffing intercepts unencrypted data transmitted over Wi-Fi networks.
On unsecured wireless networks, cybercriminals can intercept data transmissions ('sniffing') between devices and routers, potentially capturing login credentials or emails. Using encrypted networks (like HTTPS or VPNs) is key protection.
Strong, long passwords significantly increase resistance to brute force attacks.
Brute force attacks try every possible password combination. Strong, long passwords with varied character types dramatically increase the time and computational power needed to crack them, making them much harder to guess.
Dictionary attacks exploit common password patterns and lists.
Dictionary attacks use lists of common words, phrases, and patterns, including publicly available user information, to guess passwords more efficiently than random brute-force methods.
Unencrypted password files pose a severe risk if breached.
If a company stores passwords in plain text (unencrypted), a data breach can immediately expose millions of usernames and passwords, highlighting the critical need for companies to encrypt sensitive data.
Known hash values can reveal passwords if attackers match them to stolen encrypted lists.
Attackers can pre-compute hashes for common passwords. If they steal an encrypted password list, they can compare stolen hashes against their pre-computed list to identify passwords.
Security questions often have easily guessable answers, compromising account recovery.
Answers to security questions (mother's maiden name, first pet) are often publicly available or easily guessed, making account recovery systems vulnerable. Lying or using a secondary password with the true answer is recommended.
Creating and Managing Passwords
Strong passwords use length, variety of characters, and meaningful 'stories'.
Strong passwords are long (at least 8 characters), incorporate uppercase letters, numbers, symbols, and avoid common words or patterns. Creating memorable passwords can involve basing them on personal stories or sentences, with substitutions.
Avoid trivial passwords, keyboard patterns, and commonly shared examples.
Weak password choices include trivial passwords ('password', '12345'), keyboard patterns ('asdfjkl'), and common examples found in tutorials, as these are easily guessed by attackers using automated lists.
Securely recording passwords requires discretion and off-computer storage.
If writing passwords down, use pen and paper, store in a secret location, avoid clear labels like 'passwords', and use a personal coding system. Avoid storing passwords in unencrypted computer files.
Rank accounts by importance (tiers) to manage password complexity and change frequency.
Tier 1 accounts (high stake, e.g., banking) need strong, unique passwords changed every six months. Tier 2 (medium stake, e.g., social media) need strong, unique passwords changed annually. Tier 3 (low stake) can reuse strong passwords.
Password management software and browser features offer convenience but require master password security.
Password managers and browser features can remember and auto-fill passwords, reducing typing and vulnerability to keyloggers. However, the master password for these tools becomes a single point of failure and must be highly secured.
Email Security
Email systems involve user agents, message transfer agents (MTAs), and protocols like SMTP.
Emails are composed in user agents (applications like Outlook or Gmail), sent via MTAs using SMTP (Simple Mail Transfer Protocol) across the internet, and stored until accessed by the recipient's user agent.
Email addresses specify the recipient username and the receiving message transfer agent (mail server).
An email address like 'bob@dougj.net' directs the email to the user 'bob' at the mail server identified as 'dougj.net'.
Email headers contain routing information and message details (MIME).
Email headers, attached during transit, record the path the email took through MTAs and include MIME information detailing content types (text, images, attachments), which is essential for understanding email structure.
Eavesdropping threats include physical observation and wireless network sniffing.
Eavesdropping on email traffic includes direct observation (shoulder surfing) and wireless sniffing (intercepting radio signals), which can expose unencrypted emails and login credentials.
Spam is unsolicited advertising, while phishing scams aim to steal sensitive information.
Spam is typically harmless junk mail. Phishing scams, however, impersonate legitimate entities via email to trick recipients into revealing usernames, passwords, or financial data, often by directing them to fake websites.
Email spoofing fakes the sender's address, making it hard to verify legitimacy.
Spoofing involves faking the return address on an email. While email systems don't require accurate return addresses for delivery, examining email headers is crucial to detect spoofed messages.
Malicious email attachments can deliver malware disguised as legitimate files.
Cybercriminals use email attachments (e.g., disguised executable files) to deliver malware. Curiosity or social engineering tactics often encourage users to open these dangerous attachments.
Reply All and Forward functions facilitate accidental or intentional information sharing.
The ease of replying/forwarding makes sharing sensitive information (passwords, private photos) simple, even accidentally. Trust in recipients can be temporary, and 'Reply All' can inadvertently broadcast messages widely.
CC and BCC fields manage recipients with differing levels of visibility.
Carbon Copy (CC) lists recipients visible to all. Blind Carbon Copy (BCC) lists recipients hidden from all others, useful for maintaining privacy in mass communications like surprise party invitations.
Malware Varieties and Functions
Malware is software designed to harm users or steal information.
Malware is a portmanteau of 'malicious' and 'software', referring to programs intended to harm computer users, cause irritation, or steal information.
Viruses attach to host files and require user action or interaction to spread.
A computer virus is an unwanted program that attaches itself to a host file. It copies itself, but requires action like sharing infected files (via USB, email) to spread to new hosts.
Worms are self-sufficient programs that spread autonomously across networks.
Unlike viruses, worms are independent programs that can spread themselves across networks without needing a host file or direct user interaction, often targeting network resources to slow them down.
Trojan horses disguise malware as legitimate, enticing files to trick users into downloading them.
Trojan horses appear as valuable downloads (games, software) but contain hidden malware. Users voluntarily download them, similar to the mythological Trojan Horse. They don't necessarily spread like worms.
Bots (robots) automate malicious user-like functions, often controlled remotely.
Bots are malicious programs that automate tasks typically done by users (sending emails, browsing sites). They can run undetected and receive commands from a 'bot master', potentially forming botnets.
Malware can overwhelm system resources like bandwidth, storage, or processing power.
Certain malware, particularly worms, can consume excessive network bandwidth or system resources (computing power, memory), rendering the system sluggish or useless until the malware is removed.
Malicious adware displays unwanted, offensive, or deceptive advertisements.
Malicious adware, installed without consent, displays unwanted pop-ups, toolbars, or offensive ads, often directing users to malicious websites or facilitating further infections.
Spyware secretly monitors user activity, including keystrokes and browsing habits.
Spyware collects information about user activity, such as keystrokes (keylogging) or browsing habits, typically remaining hidden to send data to third parties.
Ransomware encrypts files or locks systems, demanding payment for their return.
Ransomware encrypts user files or locks the system, displaying a message demanding payment (a ransom) for decryption or access. It may be a bluff or genuinely encrypt data, but paying is not recommended.
Backdoors provide secret access points for cybercriminals to update or install more malware.
Malware can create secret connections ('backdoors') allowing cybercriminals to remotely update the malware, install additional malicious software, or gain further control over the infected system.
Malware can disable critical security functions like antivirus software or patches.
Some malware disables security measures like antivirus programs or prevents the installation of security patches, increasing the system's vulnerability and lifespan of the malware.
Botnets are networks of compromised computers controlled by a botmaster.
Botnets are large networks of computers infected with bots, controlled remotely by a 'botmaster'. They are used for large-scale attacks like crashing websites (DDoS) or sending spam.
Sources of Malware
Removable media like USB drives can carry boot sector viruses.
Historically, floppy disks and now USB flash drives can carry boot sector viruses. Leaving infected USB drives in public places is a tactic to infect users who try to return them.
Documents and executables can contain viruses, requiring user interaction to activate.
Files like word processor documents or PDF files can harbor viruses. These viruses only activate if the user opens the infected file, highlighting the need for caution with shared files.
Internet downloads are a common source of Trojan horses.
Trojan horses often originate from internet downloads, where malware is disguised as legitimate files (like free games). Downloading from untrusted sources or clicking suspicious offers increases risk.
Network connections enable worms to spread autonomously.
Worms can spread across networks (wired or wireless) without user interaction by exploiting known software security weaknesses. Keeping software patched and using firewalls helps prevent this.
Email attachments are frequently used for social engineering malware delivery.
Malicious actors attach malware-infected files to emails, often using social engineering tactics (e.g., fake invoices, tempting file names like 'loveletter') to trick recipients into opening them.
Drive-by downloads infect computers simply by visiting a malicious website.
Visiting a compromised website can trigger the automatic download and installation of malware without user interaction, known as a drive-by download. Avoiding suspicious links is crucial.
Pop-ups can lead users to malicious sites or trick them into downloading malware (Scareware).
Pop-up ads can redirect users to malicious sites with drive-by downloads or prompt downloads of malware. 'Scareware' pop-ups mimic security warnings to frighten users into installing malicious software.
Malicious advertisements can link to phishing sites or trigger malware downloads.
Advertisements purchased on legitimate sites can be malicious, leading users to phishing sites or initiating malware downloads upon clicking. Ad blockers and cautious clicking are advised.
Layers of Defense Against Malware
Backing up data provides a recovery option if systems are compromised.
Regularly backing up important files to external media (CDs, USBs, external drives) or cloud storage ensures data can be recovered even if the primary system is infected with malware.
Firewalls act as a barrier between a computer/network and the internet, screening traffic.
Firewalls (hardware or software) monitor and control incoming and outgoing network traffic, blocking unauthorized or unrequested connections from potentially malicious sources while allowing legitimate traffic.
Installing software patches covers known security weaknesses exploited by malware.
Software developers release patches (updates) to fix security vulnerabilities. Regularly installing these patches is crucial to prevent malware from exploiting known weaknesses in the software.
Antivirus software detects, blocks, and sometimes removes malware.
Antivirus software acts like a guard dog, identifying known malware by its code, alerting users, blocking attacks, and potentially removing infections. Keeping it updated is vital for detecting new threats.
User education empowers individuals to actively participate in their own cybersecurity.
Understanding cybersecurity principles, recognizing attacker tactics, and staying informed about new threats transforms users from passive victims into active participants capable of making informed security decisions.
How Web Browsing Works
Web browsers use HTML, HTTP, and plugins to display web content.
Web browsers (like Firefox, Chrome) interpret HTML code to display web pages, use HTTP for communication with web servers, and employ plugins (PDF viewers, Flash) and internal executables to handle diverse content.
Browser cache speeds up page loading by storing previously accessed data.
A browser's cache stores parts of frequently accessed web pages locally, allowing them to load faster on subsequent visits by reducing the need to download all data again from the web server.
HTML allows web pages to display local or remote images and external content.
HTML code allows web pages to embed images and other content. 'Local' images are uploaded with the page; 'remote' images are hosted elsewhere. This distinction is vital for identifying potentially deceptive pages.
Hyperlinks in HTML can be programmed to lead to different destinations than their displayed text suggests.
The displayed text of a hyperlink (what the user sees) can be intentionally misleading, directing the user to a different URL than indicated. Hovering over a link reveals its true destination, a key security check.
Web browser settings control how files are handled to balance security and convenience.
Users can configure browser settings to automatically open specific file types or to prompt for permission first. Manually handling files offers greater security, while automatic processing is more convenient.
Safe Web Browsing Practices
Configure browser file handling to prompt for permission for better security.
Manually selecting how the browser handles files (instead of automatic execution) adds a security layer, allowing users to screen potentially malicious downloads or embedded content.
Cookies enable website features but tracking cookies raise privacy concerns.
Cookies enhance user experience (remembering logins, cart items) but 'tracking cookies' can monitor browsing activity across sites for targeted advertising, raising privacy issues.
HTTPS encrypts traffic, protecting data from eavesdropping, especially sensitive information.
HTTPS (Hypertext Transfer Protocol Secure) encrypts communication between a browser and website, protecting data like login credentials from being intercepted on unsecure networks. Always look for the padlock icon.
Browser history stores visited sites, posing a privacy risk if not managed.
Web browser history logs all visited sites. This can be a privacy risk, especially on public computers. Clearing history, managing cookies, or using private browsing modes help mitigate this.
Online Shopping Security
Employ a defense-in-depth strategy (backups, firewall, patches, antivirus, education) for safe online shopping.
Safe online shopping requires a multi-layered defense strategy, including data backups, firewalls, updated software, antivirus protection, and user education to mitigate malware risks.
Use strong, unique passwords for online shopping accounts to protect sensitive data.
Strong, unique passwords are vital for online shopping accounts, which often store financial information and addresses. Weak passwords make accounts vulnerable to compromise.
Avoid conducting financial transactions on untrusted or public computers.
Sensitive financial transactions should only be performed on trusted personal computers. Untrusted computers, especially public ones, may have keyloggers or spyware capable of stealing credentials and payment information.
Refrain from shopping on unsecured wireless networks due to sniffing risks.
Unsecured wireless networks allow for data interception ('sniffing'). Sensitive financial information transmitted over these networks can be easily captured by cybercriminals.
Be wary of malicious ads promising deals that are 'too good to be true'.
Malicious advertisements often lure users with unbelievably low prices or free offers, directing them to phishing or malware-laden websites. Always verify URLs and avoid clicking unfamiliar ads.
Phishing emails and websites attempt to steal login and financial details for online retailers.
Phishing scams often involve fake emails or counterfeit retail websites designed to trick users into divulging login credentials or payment information for online stores.
Distinguish legitimate retailers by checking URLs, HTTPS usage, and requested information.
Legitimate retailers use secure HTTPS for transactions, have verifiable phone numbers and physical addresses, and do not ask for unnecessary information like Social Security numbers. Counterfeit sites often use suspicious URLs or lack HTTPS.
Use link scanners (e.g., Web of Trust) to assess the reputation of hyperlinks.
Link scanners provide reputation ratings (often color-coded) for websites linked in search results or emails, helping users avoid potentially malicious or untrustworthy sites.
Research unfamiliar retailers by checking for contact info, physical presence, and reviews.
Before shopping with a new retailer, verify their legitimacy by checking for a phone number, physical address, and independent online reviews, while being aware that reviews can sometimes be faked.
Withhold non-essential personal information from retailers to enhance privacy.
Provide only necessary information for transactions. Withholding non-essential details like date of birth or gender limits data exposure and potential targeting for advertising or identity theft.
Use credit cards over debit cards for online purchases due to better fraud protection laws.
In the US, credit cards offer stronger legal protections against fraud ($50 liability limit regardless of reporting time after initial discovery) compared to debit cards, making them a safer choice for online transactions.
Wireless Network Security
Wi-Fi networks transmit data via radio waves vulnerable to interception.
Wi-Fi transmissions between devices and routers use radio waves that radiate outwards and can be intercepted by anyone within range. Cellular networks use different, generally more secure, technologies.
SSID (network name) broadcasts availability, but can be hidden for added security.
SSIDs are router names broadcast to indicate network availability. Disabling SSID broadcast makes it harder for attackers to even detect a Wi-Fi network.
Wireless sniffing intercepts unencrypted Wi-Fi traffic.
Sniffing involves using software/hardware to intercept and read unencrypted radio wave transmissions on a Wi-Fi network. Encryption (WPA2, HTTPS, VPNs) is the primary defense.
Rogue routers are illegitimate devices set up to steal user data.
Attackers set up rogue routers (e.g., 'Free Airport WiFi') to trick users into connecting, then sniff traffic or charge fees while stealing credentials.
Evil twin routers mimic legitimate network names to trick devices into connecting.
Evil twin routers use the same name (SSID) as legitimate networks (e.g., 'University Wi-Fi'). Devices configured to auto-connect may link to the attacker's router, enabling sniffing.
Unauthorized connections (piggybacking) exploit unsecured home networks.
Allowing unauthorized access to home Wi-Fi (piggybacking) can slow connections, allow router setting changes, enable sniffing, and potentially lead to legal issues if the unauthorized user commits cybercrimes traced to your network.
Using public Wi-Fi for sensitive activities risks traffic interception and malicious network access.
Public Wi-Fi can be insecure due to sniffing, rogue routers, or evil twins. Refrain from private business (banking, shopping) on public networks, use HTTPS, obscure your screen, and consider a VPN.
VPNs create encrypted tunnels for secure internet access, especially on public networks.
A Virtual Private Network (VPN) encrypts all internet traffic between a device and a private network (like a corporate or home network), providing a secure channel even over insecure public Wi-Fi.
Strong router passwords and encryption (WPA2) are essential for home network security.
Changing default router passwords and enabling strong encryption like WPA2 prevents unauthorized access and protects wireless signals from being easily intercepted and read.
Router firewalls add an extra layer of protection against unauthorized network access.
Enabling the router's built-in firewall complements computer firewalls, providing an additional defense against unwanted network traffic.
MAC address filtering allows only approved devices to connect to the network.
MAC address filtering restricts network access to a predefined list of devices, requiring each device's unique MAC address to be registered with the router.
Turning off the router when not in use eliminates connectivity risks.
Disabling the router when not in use prevents any remote attacks or unauthorized usage and also saves electricity.
Social Media Privacy and Security
Privacy is control over who knows what information about you and when.
Privacy is defined as having control over who knows information about you, what specific information they know, and when they gain access to it. Social media inherently involves a trade-off in privacy.
Friend gluttony on social media risks sharing private info with unknown individuals.
Accepting too many friend requests from people you don't know well ('friend gluttony') can lead to unintentionally sharing private information with strangers, as social media treats all 'friends' equally by default.
Digital information is easy to copy and share, making online privacy relative.
Information shared online, even on perceived 'private' social networks, can be easily copied and distributed by others. Users should be cautious about what they share and whom they connect with.
Potential employers often vet social media profiles; prepare for this scrutiny.
Prospective employers frequently review candidates' public social media profiles. It's important that these profiles present a positive image and do not contain compromising content. Some employers may even request passwords.
Burglars use social media to research potential targets and determine occupancy.
Burglars exploit social media posts (vacation plans, check-ins, photos of valuables, house layouts) to gather information about a home's occupancy and contents, making targeted burglaries easier.
Limit personal information shared online to reduce vulnerability to social engineering and crime.
Avoid posting sensitive personal details (address, phone, credit card info, revealing photos) online. Using pseudonyms or altered names adds a layer of security against identification by strangers or criminals.
Be cautious of phishing scams and malware spread through social media links and apps.
Malware like worms (e.g., Kubeface) can spread via links shared on social media. Be wary of suspicious links from friends (call them to verify) and vet any social media applications before granting them access to your profile information.
Exercise caution with social media applications, limiting the permissions granted to them.
Social media applications, even legitimate ones, request access to profile information. Illegitimate apps can harvest data for sale or phishing. Always research apps and grant only necessary permissions.
Interpersonal and Communication Issues Online
Anonymity online can empower both positive self-expression and negative behavior.
Online anonymity can enable shy individuals to communicate freely, but it also empowers some users to engage in inflammatory or disrespectful behavior they wouldn't exhibit in person. Online actions can often be traced.
Written communication online lacks non-verbal cues, increasing the risk of misinterpretation.
The absence of tone of voice, facial expressions, and body language in online text can easily lead to misinterpretations of intent. Reading messages generously and seeking clarification is advisable.
Assume nothing shared electronically is truly private; digital information can persist indefinitely.
Accept that electronic information is rarely 100% private and can persist online long after deletion. Avoid sharing highly sensitive information (secrets, compromising photos) electronically.
The internet retains information, making online actions difficult to fully erase.
Published online information tends to be copied and saved across multiple computers, making complete deletion extraordinarily difficult. What is posted online can potentially exist forever.
Credibility online depends on verifiable information and transparency.
Establishing credibility online requires transparency and verifiable information. Anonymity and lack of context can make it difficult to assess the trustworthiness of online sources or individuals.
Ask a Question
*Uses 1 Wisdom coin from your coin balance