Internet Safety and Security
Student’s Name:
Institution:
Internet Safety and Security
Introduction
For many of us, the internet is something we cannot be without. We use it for most of our daily tasks. We shop online, share our personal experiences on social media, take classes, work, bank, and so much more. Think about the last time you purchased something online. Was it an easy experience? As easy as it was to make that purchase, your information could have been compromised. How do we know if our information is safe and secure online? The normal livelihood revolves around the internet and virtual transactions as occasioned by the rise in the internet of things, technology, innovations, and inventions worldwide. The increased use of the internet to conduct operations makes them easy and convenient for the people, thus attracting huge numbers to users. Huge personal and sensitive data are exchanged and used daily to enable different transactions, and such data need to be secure as their exposure to third and malicious parties can compromise transactions and result in irredeemable losses (Wolf and Serpanos, 2017). Virtual transactions and operations are prone to cybercrimes, such as privacy invasion, cyberstalking, online harassment, identity theft scams, phishing scams, and extortion, thus making the users vulnerable. Online transactions and operations are subjected to cyber-crimes that compromise them; thus, there is a need to adopt the best practices and approaches for internet safety and security.
Abstract
Cybercriminals have increasingly used tactics directed towards compromising online transactions at their benefits and at the users’ expense, thus calling for the employment of the necessary security measures and approaches to secure them. The cybercrimes occur when transactions and data related to transactions are intercepted by cybercriminals and used to their advantages. Increased cybercrime has raised questions and consciousness on the security of virtual transactions, structures, and measures to ensure that transactions are secure and approaches adopted in the libraries to ensure the safety and security of the stored information. The threat and risk of virtual operations are real and evident, and thus there is a need to adopt the best and necessary measures to ensure the safety and security of transactions, operations and data.
Main Topics
A. How secure is our information online:
The security of online information has been in question as occasioned by different cybersecurity cases characterized by a data breach. The cybercriminals engage in data security breaches with the intention of illegal financial and social gains at the expense of the common good of different online users. There have been different data security breaches across the globe that can be explained and their statistics recorded.
a. Examples of data security breaches that have occurred in the past
Different professions and fields have experienced data breach security, thus negatively affecting their operations and users. The data security breaches are characterized by a man-in-the-middle, denial of service, drive-by attacker phishing, SQL injection Attacks, password attack, Eavesdrop attack, cross-site scripting (XXS) Attack, or malware attacks (Amazon, 2020). In this regard, in May 2019, an Australian graphic design tool website Canva suffered a data breach attack that affected 137 million account users. The attack resulted in the exposure of different data and information in the form of passwords, salted, cities of residence, names, usernames and email addresses. The company recorded that hackers managed to view the data and information, but they did not manage to steal it. In this case, the cybercriminals were the Gnosticplayers who, after the attack, contacted ZDNet boasting about the incident. The attacker said that Canva detected the attack and closed the data breach server and that they gained access to OAuth login tokens for the users. The users were notified of the attack incident and the appropriate measures to take, such as the change of passwords.
In May 2014, eBay experienced a data breach attack that affected a million users. In this attack, different forms and kinds of data such as the encrypted passwords, dates of birth, addresses and names were exposed (Amazon, 2020). In this case, the cybercriminals used the credentials of three corporate employees to access the network for 229 days that made them effectively compromise the user database. After the attack, eBay, an online auction giant, requested the customers to change their passwords, and other financial information such as credit card numbers were not compromised as they were kept separately.
On July 29th, 2017, a security data breach affected Equifax, thus affecting 147.9 million users. Equifax, a data breach attack, left the organization vulnerable (Amazon, 2020). The breach has started in May and was discovered on July 29th, and it resulted in a compromise of personal information such as social security numbers, addresses, birth dates and drivers` license numbers. Additionally, credit card information for 209,000 consumers were exposed in the data breach attack. The attack was made possible by the application vulnerability that made the attackers access since it was unpatched. The system’s existing vulnerability gap was the inadequate system segmentation that made it possible for the attackers to succeed. Equifax was faulted for various security and response lapses and a slow report of the breach.
In September 2018, Facebook was exposed to a data breach attack on its computer network, leading to personal data exposure for 50 million users. In this case, the hackers achieved in their attack by capitalizing on the exploitation of the vulnerability in the code used for the “View as” feature (Nelson and Simek, 2020). The feature made it possible for hackers to steal access tokens that could be used to take over users’ accounts and gain access to other services at the users’ expense. The attack further affected third-party applications linked to Facebook, leading to logging out of accounts and resetting of access tokens. In this case, the attack was one of the largest leading to the fall out of Facebook with Cambridge Analytical Scandal, and it resulted in ongoing allegations that the platform was used in Russia for disinformation campaigns. Additionally, the Irish Data Protection Commission opened a formal investigation into the breach resulting in huge fines. Therefore, Facebook, the breach resulted in significant damage on Facebook.
Additionally, between August 21st and September 5th, 2018, a data breach security was meted on the aviation industry, specifically British Airways. The data security breach exposed personal data for 380,000 customers (Silverman, 2015). The airline confirmed that customers’ personal and financial details making and changing bookings had been compromised for two weeks. The hackers gained access to personal and sensitive data and information composed of names, addresses, email addresses, credit card numbers, security codes and expiry dates. More so, travel and passport details were not affected by the breach.
b. Why and how did these data breaches happen
The cybercriminals and hackers have used different tactics and methods of implementing data breaches for different reasons. Canva data security attack was initiated through the password attack approach. The illegal access of the users’ usernames and passwords makes hackers hack computer and network systems. The hackers access the password through searching network connections and social engineering tactics. The data breach, in this case, was directed towards negatively affecting the reputation of Canva.
The attack on eBay was implemented through a password attack that made the attackers steal corporate members of the staff’s identity. The hackers accessed the credential of three corporate members that made them access eBay’s computer and network systems to defraud the customers and the users of the website.
The data breach attack on Equifax was made possible by capitalizing on the existing computer system gaps and vulnerability. In this regard, The Equifax application had vulnerability since some parts of the system were unpatched. In this case, the attack was directed towards defrauding the users and negatively affecting the organizational reputation.
The data breach attack on Facebook was made possible by using system vulnerability existing in the application. The vulnerability was on the “view as” feature that made the hacker access the system. In this case, the Facebook attack was done to compromise the operations and functions of Facebook.
The data breach attack on British Airways was made possible through the injection of SQL. The SQL commands make it possible to run predefined SQL commands that can read sensitive data, issues command, modify data and execute operations. The attack, in this case, was directed towards compromising the operations of British Airways.
c. Recent statistics
The recent statistics indicate that data breach has increased considerably in the year 2018. Billions of people worldwide have had their data exposed and stolen, leading to increased frequency and severity of breaches (Xu et al., 2019). A report by a digital security company Gemalto revealed that 945 data breaches happened in the first half of 2018, leading to 4.5 billion data being compromised. The record was a 133% increase in six months.
B. What structures are in place, keeping our information safe and secure:
Online operations are subjected to security risks and threats, and thus there is a need to adopt the necessary secure structure to prevent and address them when they occur. This approach ensures that virtual operations are done in a secure network, system and computer environment.
a. Computer software and antivirus
Computer software and antivirus are an effective approach to ensure that computers and networks’ security is upheld. Computer software and antivirus are adopted in countering security risks and threats (Egitmen et al., 2020). Cybersecurity software is developed in the interest of achieving information security. The security computer software ensures that intrusion is prevented, and there is an authorization of resources. In this regard, a wide range of computers includes access control, anti-key loggers, anti-tamper software, anti-spyware, intrusion detection system, intrusion prevention system, firewall anti-subversion and antivirus software.
The access control software in computers and systems ensures a selective restriction to the access of the computer and its different systems. The access control system comprises login credentials and locks to determine the person to access or deny access to the computer system (Steffee, 2020). The access control system operation authenticates the user by using authentication information such as password, pin, smart card, and fingerprints. In this case, the software ensures that only authorized persons can access the computer and its network.
The anti-keylogger computer software ensures that keystroke loggers are prevented from accessing the computer through deletion or immobilization of the keystroke logger software on the computer (Min et al., 2014). The anti-keylogger software flags all the keystroke-logging programs, but some are removed optionally to ensure that they are all legitimate.
The anti-malware, also referred to as the antivirus software as a computer program, ensures that malware is prevented, detected and removed. Malware destroys the computer system and network, and thus they should be prevented or removed from the system (Min et al., 2014). Different malware and other computer threats can be eliminated using anti-malware software. Additionally, other malicious threats can be eliminated by anti-malware software such as browser helper objects, spyware, fraud tools, browser hijackers and Trojan horses.
The anti-subversion software ensures that subversion is effectively detected to eliminate the side effects of the hack. In software subversion, the software is inclined to perform unintended actions by tampering with the code or changing its behavior (Min et al., 2014). In this regard, the anti-subversion software effectively detects the subversion and makes the necessary steps and procedures to end the hack’s effects. In this regard, the software ensures that software operates as designed and intended to perform without interference.
The anti-tamper computer software ensures that the modifying of the existing system is made hard. The anti-tamper software uses techniques that make a program malfunction or dysfunctional when it is modified (Kim et al., 2015). The software is a combination of trusted hardware, and copy protection that takes passive measures such as obfuscation ensures that reverse engineering is difficult effective tampering detection techniques.
The cryptographic software is encryption software that adopts cryptography to eliminate unauthorized access to digital information or online platforms (Kim et al., 2015). Cryptography is adopted when securing digital information held in computers and digital information being transferred from one computer to another over the internet. Cryptography ensures that data at rest and data on transit is safe and secure from malicious damage and compromise.
Additionally, the intrusion detection system as a computer system ensures that the system effectively detects malicious operations and policy violations in the system (Kim et al., 2015). The software ensures that mistakes and violations detected are reported to the administrator with the help of a security information and event management (SIEM) system. In this regard, the detection of malicious activities ensures that the system or the administrator responds effectively, thus securing the system.
b. Personal responsibility and awareness
Personal responsibility and awareness are vital aspects in the course of securing computer systems and networks. In this regard, personal responsibility and awareness are achieved by adopting the best practices, effective approaches and the observation of set policies and regulations. First, there is a need to make decisions responsibly to ensure that internet and computer security is not compromised (Hatlevik and Tomte, 2014). The effective use of the internet and computers requires consistently making constructive choices on social interactions and internet use. The choices made needs to be based on safety concerns, ethical standards and social norms. Responsible decisions ensure that security measures and considerations are made in using the internet and computers to the point of achieving high-security standards.
The computer and internet users need to focus on the purpose and the main agenda of their work to ensure that security is not compromised by engaging in additional operations (Hatlevik and Tomte, 2014). The best way to uphold safety and responsible internet use to ensure that computers and the internet are put to their intended and original use to take the relevant security measures, regulations and policies. Mixing of professional activities and other activities related to confusion to disregard the set security measures.
The set security policies and regulations need to be well communicated to all parties that need to observe them or be bound by the rules (Hatlevik and Tomte, 2014). In this regard, the security measures need to be emphasized through teaching and repeated from time to time to ensure they have a complete understanding. This approach ensures that the measures are consistent practices to the point that they become a norm, thus attaining safety and security measures.
Supervision and monitoring need to be emphasized as personal responsibility and awareness in securing the internet and computers by the users (Hatlevik and Tomte, 2014). Internet users and computers need to be supervised to ensure that they observe the set policies and guidelines. Supervision and monitoring ensure that the users observe high levels of discipline since they are sure that disregarding the rules or misuse of the internet and computers will be easily and immediately detected.
C. What are libraries doing to keep patrons’ information safe and secure:
The fact libraries run virtual operations and contain different materials that are prone to security risks and threats. In this regard, there is a need to adopt the relevant security measures to secure the online learning resources in the library.
a. Patron records
Patron records are confidential as they contain personally identifiable information about the library users, and thus they should be protected from third parties or unauthorized parties. In this regard, the patron records need to be effectively protected to avoid making the lives of the library users vulnerable. First, patron records need to be protected by developing a preservation policy as a sustainable digital preservation program (Lamanna, 2019). The policy addresses different issues of concern such as scope and objectives, legal and technical issues to be observed, roles and responsibilities in the preservation and the process of monitoring and reviewing the records and the preservation program.
The patron record safety needs to be aligned to the technological needs and changes in the cybersecurity world (Lamanna, 2019). The cybersecurity world is dynamic, and cybercriminals keep changing their technology and hacking techniques; thus, the patron record system needs to consistently upgrade the security technology to counter the security threats and risks. The patron record system needs to be steps ahead in securing the record to ensure that the system does not create gaps or that there is no system vulnerability.
Security measures and access control measures need to be adopted in securing patron records (Lamanna, 2019). The library system needs to have wide security controls composed of limitations to user access to computer systems and control regarding physical control of electronic records. In this case, the security measures need to address the physical security infrastructure, information technology systems, and access and permission measures.
b. Library Wi-Fi and computers
Library Wi-Fi and computers are subject to misuse and can be compromised through hacking to illegally access online resources and records, and thus effective protective and preventive measures need to be adopted (Singh and Margam, 2018). In this regard, monitoring the browser activity ensures that malicious operations and activities are detected and eliminated before negatively affecting the organizational operations and processes.
The library’s online resources such as computers need to be regularly maintained to ensure that they work properly, and computer software is designed to detect the users’ privacy is active and efficient (Singh and Margam, 2018). Routine maintenance takes the security audit of computers to locate security gals and vulnerabilities. The elimination of gaps and vulnerabilities ensures that security programs and software are efficient.
Wi-Fi password needs to be managed and regulated to ensure that they are not mismanaged or misused by the users or malicious parties (Singh and Margam, 2018). For instance, the passwords need to be regularly changed to ensure that they are not misuses. This approach ensures that the Library professional can monitor and regulate the use of Library Wi-Fi.
c. Legal and ethical implications
Different legal and ethical issues arise in the course of securing library online resources and patron records. In this case, confidentiality rises, causing conflict between the library administrators and the library users. The need to maintain high confidentiality in library resources and record the library, administrators will be inclined to use stringent measures to achieve the security needs, thus creating conflict between the interested parties.
The issue of informed consent will be increasingly be achieved from the library users with increased security and privacy measures taken by the library administration. It is vital to note that patron record contains confidential information that can be used to personally identify people, and thus such information needs to be effectively guarded. The moment the library users realize that high-security measures and standards are observed, then they will be willing to give their identification details for the library use.
Conclusion
Virtual operations have consistently be exposed to security risks and threats that make them and their users vulnerable, and thus there is a need to adopt the necessary preventive and protective security measures in the form of policies, regulations, best practices and approaches to secure the online operations. It is vital to note that data security breaches have persisted across the globe due to vulnerabilities, gaps in the system, and the rise, hacking techniques that need to be countered using equivalent security countermeasures. Consequently, computer security software and antivirus have been effective in preventing and handling security issues in viruses, malware or other forms of attacks. A wide range of computer security software needs to be incorporated in computer systems and networks to secure all the virtual operations. Furthermore, personal responsibility and awareness aspects need to be used in securing online transactions as they guide the users on the safest and responsible approaches of using the internet and computers. Additionally, online library resources and records need to be secured as they are prone to abuse and insecurities from the users and malicious parties.
References
Amazon, Netflix others in internet routing security push, The Register says. (2020, April
2). The Fly. Retrieved from https://link.gale.com/apps/doc/A619239143/GPS?u=29081_mdpls&sid=GPS&xid=01d97162
Egitmen, A., Bulut, I., Aygun, R., Gunduz, A. B., Seyrekbasan, O., & Yavuz, A. G. (2020). Combat Mobile Evasive Malware via Skip-Gram-Based Malware Detection. Security and CommunicationNetworks, 2020.Retrievedfrom https://link.gale.com/apps/doc/A628068170/AONE?u=29081_mdpls&sid=AONE&xid=ca6add21
Evolving Threat. Law Practice, 46(3), 24+. Retrieved from https://link.gale.com/apps/doc/A627386621/AONE?u=29081_mdpls&sid=AONE&xid=c72e1aa0
Hatlevik, O. E., & Tømte, K. (2014). Using multilevel analysis to examine the relationship between upper secondary students Internet safety awareness, social background and academic aspirations. Future Internet, 6(4), 717-734. Retrieved from https://www.mdpi.com/1999-5903/6/4/717
Kim, D. W., Yan, P., & Zhang, J. (2015). Detecting fake anti-virus software distribution webpages. Computers & Security, 49, 95-106.
Lamanna, T. (2019). On Educating Patrons on Privacy and Maximizing Library Resources. Information Technology and Libraries, 38(3), 4-7.
Min, B., Varadharajan, V., Tupakula, U., & Hitchens, M. (2014). Antivirus security: naked during updates. Software: Practice and Experience, 44(10), 1201-1222.
Nelson, S. D., & Simek, J. W. (2020, May-June). Ransomware as a Data Breach: An
Retrieved from https://ejournals.bc.edu/index.php/ital/article/view/11571
Silverman, D. L. (2015). Developments in data security breach liability. The Business Lawyer, 71(1), 271-280. Retrieved from https://www.jstor.org/stable/26417553
Singh, V., & Margam, M. (2018). Information security measures of libraries of Central Universities of Delhi: A study. DESIDOC Journal of Library & Information Technology, 38(2), 102. Retrieved from http://search.proquest.com/openview/fc8c79e7db7a3e52cada13c6baa7ea71/1?pq-origsite=gscholar&cbl=2028807
Steffee, S. (2020, April). INSIDER THREATS PUT DATA AT RISK: Human error is behind most data breaches, research says. Internal Auditor, 77(2), 11+. Retrieved from https://link.gale.com/apps/doc/A623697100/AONE?u=29081_mdpls&sid=AONE&xid=f6eec71b
Wolf, M., & Serpanos, D. (2017). Safety and security in cyber-physical systems and internet-of-things systems. Proceedings of the IEEE, 106(1), 9-20.
Xu, H., Guo, S., Haislip, J. Z., & Pinsker, R. E. (2019). Earnings management in firms with data security breaches. Journal of Information Systems, 33(3), 267-284.
