UNIT 5

Internet Security and Cyber Laws

Q] Define Firewall.
Q] Explain need for firewall.

A firewall is a network security device that monitors incoming and outgoing network traffic and
permits or blocks data packets based on a set of security rules.
Its purpose is to establish a barrier between your internal network and incoming traffic from
external sources (such as the internet) in order to block malicious traffic like viruses and hackers.
Firewalls can be an effective way of protecting a local system or network of systems from network-
based security threats while at the same time affording access to the outside world via wide area
networks and the Internet.

Types of firewall:
1. Packet Filter
2. Circuit level Gateway
3. Application Gateway
4. Software
5. Hardware
6. Hybrid
7. Stateful multilayer Inspection Firewall

Q] Write a brief note on firewall configuration 6M

i) Packet filter as a firewall
ii) Application level gateway firewall
iii) Circuit level gateway firewall

 Packet Filtering Firewall

{Write below Paragraph only if asked Packet Filtering Firewall for 6 Marks else Skip}

 A firewall works as a barrier, or a shield, between your PC and cyber space.

 When you are connected to the Internet, you are constantly sending and receiving
information in small units called packets.
 The firewall filters these packets to see if they meet certain criteria set by a series of rules,
and thereafter blocks or allows the data.
 This way, hackers cannot get inside and steal information such as bank account numbers
and passwords from you.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Working:-
A packet filtering router firewall applies a set of rules to each packet and based on outcome, decides
to either forward or discard the packet.
Such a firewall implementation involves a router, which is configured to filter packets going in
either direction i.e. from the local network to the outside world and vice versa.
A packet filter performs the following functions.

1. Receive each packet as it arrives.

2. Pass the packet through a set of rules, based on the contents of the IP and transport header
fields of the packet. If there is a match with one of the set rule, decides whether to accept or
discard the packet based on that rule.
3. If there is no match with any rule, take the default action. It can discard all packets or accept all
packets.

This firewall will act according to the table.

For example, Consider table has entry for Source IP [Link]. It is the IP address of a network , all
the packets which are coming from this network will be blocked by the firewall.
Consider Table is also having entry for port 80, IP Address [Link] & port 23.
Port 23 is for Telnet (TELecommunication NETwork) remote login. In this case firewall won’t allow to
login onto this server.
IP Address [Link] is the IP address of individual Host, all the packet having this IP address as a
destination address will be denied.
Port 80 is default port for HTTP. Firewall will not allow any web browsers to request and receive web
pages from servers.

Advantage:

The Biggest Advantage of Packet Filtering Firewalls is Cost and Lower Resource Usage and best suited
for Smaller Networks.
Simplicity,
Transparency to the users,
High speed

Disadvantage:
Packet Filtering Firewalls can work only on the Network Layer and these Firewalls do not support
Complex rule based models
It is also Vulnerable to Spoofing in some Cases.
It is difficult to set up packet filtering rules

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

2. Circuit level gateway Firewalls:

The circuit level gateway firewalls work at the session layer of the OSI model.
They monitor TCP handshaking between the packets to determine if a requested session is
legitimate.
If the initial handshake matches established security policies, the gateway permits the connection.
It creates a virtual circuit for the duration of the session, across which all traffic is allowed to flow
unimpeded.
The information passed through a circuit level gateway, to the internet, appears to have come from
the circuit level gateway.
So, there is no way for a remote computer or a host to determine the internal private ip addresses
of an organization, for example.
This technique is also called Network Address Translation where the private IP addresses
originating from the different clients inside the network are all mapped to the public IP address
and then sent to the outside world (Internet).
This way, the packets are tagged with only the Public IP address and the internal private IP addresses
are not exposed to potential intruders

3. Application level gateway Firewalls (Proxy Firewalls):

Application level firewalls decide whether to drop a packet or send them through based on the
application information (available in the packet).
They do this by setting up various proxies on a single firewall for different applications.
A proxy server is a system or router that provides a gateway between users and the internet.
Both the client and the server connect to these proxies instead of connecting directly to each other.
So, any suspicious data or connections are dropped by these proxies.
Application-level gateways can provide additional security benefits over other types of firewalls
because they can inspect the contents of data packets at the application layer, where protocols such
as HTTP, FTP, and SMTP operate.
This enables the firewall to identify and filter out traffic to detect and prevent attacks that might
attempt to exploit vulnerabilities in specific applications.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

4. Stateful multilayer Inspection Firewall (SMLI)
The stateful multi-layer inspection (SMLI) firewall uses a sophisticated form of packet-filtering that
examines all seven layers of the Open System Interconnection (OSI) model.
Each packet is examined and compared against known states of friendly packets.
While screening router firewalls only examine the packet header, SMLI firewalls examine the entire
packet including the data.
In other words, this type of filter examines packets on the network, transmission, and application
levels, comparing them to known trusted packets.
SMLI checks the entire packet and only allows it to pass through each layer individually.
Such firewalls inspect packets to assess the state of communication in order to ensure that all
facilitated communication only takes place with trusted sources.
To be more specific, an SMLI firewall is not necessarily a single firewall implementation.
Rather, it is a series of firewalls that work in concert to secure traffic at different levels of the OSI
model.
It may be a composition of a stateless packet filter, a stateful firewall, as well as an application level
proxy.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

  Firewall Policies
Firewall policies are sets of rules that control network traffic, preventing unauthorized access and
protecting against security threats by defining which traffic is allowed or blocked based on source,
destination, protocol, and port.

Q) State any two policies of the firewall 2M

Service control: Determines the types of Internet services that can be accessed, inbound or
outbound. The firewall may filter traffic on the basis of IP address, protocol, or port number; may
provide proxy software that receives and interprets each service request before passing it on; or
may host the server software itself, such as a Web or mail service.

Direction control: Determines the direction in which particular service requests may be initiated
and allowed to flow through the firewall.

User control: Controls access to a service according to which user is attempting to access it. This
feature is typically applied to users inside the firewall perimeter (local users).

Behavior control: Controls how particular services are used. For example, the firewall may filter e-
mail to eliminate spam.

 Firewall Configuration
Q) Write a brief note on firewall configuration

Configuration of firewall
There are 3 common firewall configurations.
1. Screened host firewall, single-homed bastion configuration
2. Screened host firewall, dual homed bastion configuration
3. Screened subnet firewall configuration

1. Screened host firewall, single-homed bastion configuration

In this type of configuration a firewall consists of following parts
i) A packet filtering router
ii) An application gateway.

The main purpose of this type is as follows:

• Packet filter is used to ensure that incoming data is allowed only if it is destined for
application gateway, by verifying the destination address field of incoming IP packet.
It will also ensure that outgoing traffic is allowded only if it is originated from application
level gateway, by examining the source address field of every outgoing IP packet.
• Application gateway is used to perform authentication and proxy function.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

 Fig single homed bastion configuration
Advantages:
• It improve security of network by performing checks at both levels- that is packet and
application level.
• It provide flexibility to the network administrator to define more secure policies.

Disadvantages :
Internal users are connected to the application gateway as well as packet filter router.
So if any how packet filter is attacked, then the whole internal network is exposed to the
attacker.

2. Screened host firewall, dual homed bastion configuration

To overcome the disadvantage of a screened host firewall, single homed bastion configuration, another
configuration is available known as screened host firewall, Dual homed bastion.
In this, direct connections between internal hosts and packet filter are avoided.
As it provide connection between packet filter and application gateway, which has separate
connection with the internal hosts.
Now if the packet filter is successfully attacked, only application gateway is visible to attacker.
It will provide security to internal hosts.

3. Screened subnet firewall configuration

It provides the highest security among all firewall configurations.
It is improved version over all the available scheme of firewall configuration.
It uses two packet filters, one between the internet and application gateway and another between
the application gateway and the internal network.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Thus this configuration achieves 3 levels of security for an attacker to break into.

Limitations of Firewall :-
1. Firewall do not protect against inside threats.
2. Packet filter firewall does not provide any content based filtering.
3. Protocol tunneling, or encapsulating one protocol within another, can bypass firewalls by
hiding traffic within allowed protocols, effectively negating the firewall's purpose to filter traffic
based on protocol
4. Encrypted traffic cannot be examine and filter.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

  DMZ
Describe DMZ with suitable diagram. 4M

DMZ (Demilitarized Zone):

It is a computer host or small network inserted as a ―neutral zone in a companys private network
and the outside public network.
It avoids outside users from getting direct access to a companys data server.
A DMZ is an optional but more secure approach to a firewall.
It can effectively acts as a proxy server.
The typical DMZ configuration has a separate computer or host in network which receives requests
from users within the private network to access a web sites or public network.
Then DMZ host initiates sessions for such requests on the public network but it is not able to
initiate a session back into the private network.
It can only forward packets which have been requested by a host.
The public networks users who are outside the company can access only the DMZ host.
It can store the companys web pages which can be served to the outside users.
Hence, the DMZ cant give access to the other companys data.
By any way, if an outsider penetrates the DMZs security the web pages may get corrupted but
other companys information can be safe.

Examples:
Web servers
It's possible for web servers communicating with internal database servers to be deployed in a DMZ.
This makes internal databases more secure as these are the repositories responsible for storing
sensitive information. Web servers can connect with the internal database server directly or through
application firewalls, even though the DMZ continues provide protection.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Intrusion Detection System (IDS)
Q. Describe IDS and its two types.

An Intrusion Detection System (IDS) monitors network traffic and monitors for suspicious activity and
alerts the system or network administrator.
In some cases the IDS may also respond to anomalous or malicious traffic by taking action such as
blocking the user or source IP address from accessing the network.

IDS are mainly divided into two categories, depending on monitoring activity:

 Host Based Intrusion Detection System

 Network Based Intrusion Detection System

 Host Based Intrusion Detection System (HIDS)

Q. Explain Host based IDS.

Host intrusion detection systems (HIDS) run on independent hosts or devices on the network.

A HIDS monitors the incoming and outgoing packets from the device only and will alert the
administrator if suspicious or malicious activity is detected. It takes a snapshot of existing system files
and compares it with the previous snapshot. If the analytical system files were edited or deleted, an alert
is sent to the administrator to investigate.

Basic Components HIDS:

 Traffic collector:

This component collects activity or events from the IDS to examine.

On Host-based IDS, this can be log files, audit logs, or traffic coming to or leaving a specific system

 Analysis Engine:

This component examines the collected network traffic & compares it to known patterns of suspicious or
malicious activity stored in the signature database. The analysis engine acts like a brain of the IDS.

 Signature database:

It is a collection of patterns & definitions of known suspicious or malicious activity.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

  User Interface & Reporting:

This is the component that interfaces with the human element, providing alerts & giving the user a
means to interact with & operate the IDS.

1) Host-based IDS: Host based IDS looks for certain activities in the log files are:
1. Logins at odd hours
2. Login authentication failure
3. Adding new user account
4. Modification or access of critical systems files.
5. Modification or removal of binary files
6. Starting or stopping processes
7. Privilege escalation
8. Use of certain program

2) Network based IDS: Network based IDS looks for certain activities like:
1. Denial of service attacks.
2. Port scans or sweeps
3. Malicious contents in the data payload of packet(s)
4. Vulnerability of scanning
5. Trojans, Viruses or worms
6. Tunneling
7. Brute force attacks.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Honey Pots
Q] Explain honey pots. 4M

A relatively recent innovation in intrusion detection technology is the honey pot.

Honeypots are designed to purposely engage and deceive hackers and identify malicious activities
performed over the Internet.
Honey pots are decoy systems that are designed to lure a potential attacker away from critical systems.
Honey pots are designed to:

 divert an attacker from accessing critical systems

 collect information about the attacker's activity

It encourages the attacker to stay on the system for some time, allowing the administrations to detect
this and act on this.
These systems are filled with fabricated information designed to appear valuable but that a legitimate
user of the system wouldn’t access.
Honeypots are designed for 2 important goals
1. Make them look-like full real-life systems.
2. Do not allow legitimate users to know about or access them.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

State any four difference between Firewall and Intrusion Detection System 4M

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Email Security
Explain Email Security in SMTP.

Email is emerging as one of the most valuable services on the internet today.
Email security refers to the steps where we protect the email messages and the information that they
contain from unauthorized access, and damage.

Protocols Related To Email Security are :-

1. SMTP (simple mail transfer protocol)
2. PEM (Privacy Enhance Mail)
3. PGP (Pretty Good Privacy)

SMTP (Simple Mail Transfer Protocol)

Simple Mail Transfer Protocol, a protocol for sending email messages between servers.
Most of the internet systems use SMTP as a method to transfer mail from one user to another.
SMTP is a push protocol and is used to send the mail whereas POP (post office protocol) or IMAP
(internet message access protocol) are used to retrieve those mails at the receiver’s side.
In addition, SMTP is generally used to send messages from a mail client to a mail server.
This is why you need to specify both the POP or IMAP server and the SMTP server when you
configure your e-mail application.
SMTP usually is implemented to operate over Internet port 25.
An alternative to SMTP that is widely used in Europe is X.400.
Many mail servers now support Extended Simple Mail Transfer Protocol (ESMTP), which allows
multimedia files to be delivered as email.

The basic phases of an email communication consists of the following steps :-

1. At sender’s end an SMTP server takes the message sent by uses computer
2. The SMTP server at the sender’s end then transfer the message to the SMTP server of the receiver.
3. The receiver’s computer then pulls the email message from the SMTP server at the receive’s end,
using the other mail protocol such as Post Office Protocol (POP) or IMAP (Internet mail access
protocol )

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Privacy Enhanced Mail (PEM) e-mail security:
PEM supports the 3 main cryptographic functions of encryption, nonrepudiation and message
integrity. The steps involved in PEM operation as follows.

Step 1: canonical conversion:

There is a possibility that the sender and the receiver of an email message use computers that have
different architecture and operating systems.
PEM transforms each email message into an abstract, canonical representation
This means that regardless of the architecture and the operating system of the sending and
receiving computers, the email travels in a uniform, independent format.

Step 2: Digital Signature:

It starts by creating a MD of email message using an algorithm such as MD2 or MD5.
The MD thus created is then encrypted with sender’s private key to form the sender’s digital
signature.

Step 3-Encryption:
The original email and the digital signature are encrypted together with a symmetric key.

Step 4: Base- 64 encoding-

This process transforms arbitrary binary input into printable character output.
The binary input is processed in blocks of 3 octets or 24 bits.
These 24 bits are considered to be made up of 4 sets, each of 6 bits.
Each such set of 6 bits is mapped into an 8-bit output character in this process

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443
PGP ( Pretty Good Privacy )
Describe PGP with suitable diagram. 4M

Pretty Good Privacy is a popular program used to encrypt and decrypt email over the internet.
It becomes a standard for email security.
It is used to send encrypted code (digital signature) that lets the receiver verify the sender’s
identity and takes care that the route of message should not change.
PGP can be used to encrypt files being stored so that they are in unreadable form and not readable
by users or intruders.
It is available in Low cost and Freeware version. It is most widely used privacy ensuring program
used by individuals as well as many corporations.

1. Email -> SHA 1 -> MD -> Sender Private Key -> Digital Signature
2. Input Message + Digital Signature -> Compression (Lempel -Ziv)-> File Size Reduce
3. Compressed O/P -> symmetric key ->encrypt
4. symmetric key -> receiver’s public key -> encrypt
3 + 4 -> Digital Envelop

There are five steps as shown below:

1. Digital signature:
It consists of the creation a message digest of the email message using SHA-1 algorithm.
The resulting MD is then encrypted with the sender’s private key.
The result is the sender’s digital signature.

2. Compression:
The input message as well as digital signature are compressed together to reduce the size of final
message that will be transmitted. For this the Lempel -Ziv algorithm is used.

3. Encryption:

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

The compressed output of step 2 (i.e. the compressed form of the original email and the digital signature
together) are encrypted with a symmetric key.

4. Digital enveloping:
The symmetric key used for encryption in step 3 is now encrypted with the receiver’s public key.
The output of step 3 and 4 together form a digital envelope.

5. Base -64 encoding:

This process transforms arbitrary binary input into printable character output.
The binary input is processed in blocks of 3 octets (24-bits).
These 24 bits are considered to be made up of 4 sets, each of 6 bits.
Each such set of 6 bits is mapped into an 8 - bit output character in this process.

Cybercrime :

List any types of cybercrimes

Describe cybercrime? Describe hacking related to cybercrime.
Cybercrime is defined as a crime in which a computer is the object of the crime or is used as a tool to
commit an offense.
Cybercriminals may use computer technology to access personal information, business trade
secrets, or use the Internet for exploitive or malicious purposes.
Criminals can also use computers for communication and document or data storage.
Criminals who perform these illegal activities are often referred to as hackers.
Cybercrime may also be referred to as computer crime.

Types of Cybercrimes are

1. Hacking
2. Digital Forgery
3. Cyber Stalking / Harassment
4. Cyber Pornography
5. Identity Theft and Fraud
6. Cyber Terrorism
7. Cyber Defamation

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

Hacking
List and explain different types of hackers.

Hacking is one of the most well-known types of computer crime. A hacker is someone who find out and
exploits the weaknesses of computer systems or networks. Hacking refers to unauthorized access of
another’s computer systems. Hacking often conducted in order to launch malicious programs known
as viruses, worms, and Trojan horses that can shut down entire computer network. Hacking is also
carried out as a way to talk credit card numbers, intent passwords, and other personal information. By
accessing commercial database, hackers are able to steal these types of items from millions of internet
users all at once.
There are different types of hackers:
1. White hat
2. Black hat
3. Grey hat
4. Elite hacker
5. Script hacker

There are different types of hackers:

1. White hat
2. Black hat
3. Grey hat
4. Elite hacker
5. Script kiddie hacker

1) Black Hat Hacker

 Black-hat Hackers are also known as an Unethical Hacker or a Security Cracker.
 These people hack the system illegally to steal money or to achieve their own illegal goals.
 They find banks or other companies with weak security and steal money or credit card
information.
 They can also modify or destroy the data as well. Black hat hacking is illegal.

2) White Hat Hacker

 White hat Hackers are also known as Ethical Hackers or a Penetration Tester.
 White hat hackers are the good guys of the hacker world.
 These people use the same technique used by the black hat hackers.
 They also hack the system, but they can only hack the system that they have permission to
hack in order to test the security of the system.
 They focus on security and protecting IT system. White hat hacking is legal.

3) Gray Hat Hacker

 Gray hat Hackers Are Hybrid between Black Hat Hackers and White hat hackers.
 They can hack any system even if they don't have permission to test the security of the
system but they will never steal money or damage the system.
 In most cases, they tell the administrator of that system.
 But they are also illegal because they test the security of the system that they do not have
permission to test.
 Grey hat hacking is sometimes acted legally and sometimes not.

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443

4) Elite Hacker

Elite hackers avoid deliberately destroying information or otherwise damaging the computer
systems they have exploited.

5) Script Kiddie
A script kiddie, or “skiddie,” is someone who lacks programming knowledge and uses existing
software to launch an attack.
Often a script kiddie will use these programs without even knowing how they work or what they do.

Classify following cyber crimes:

i) Cyber stalking
ii) Email harassment

Cyberstalking/ Harassment: Cyberstalking/ Harassment refers to the use of the internet and other
technologies to harass or stalk another person online, and is potentially a crime in the India under
IT act-2000.
This can be done with the help of many protocols available such as e- mail, chat rooms, user net
groups.

Email harassment : Email harassment is a form of stalking in which one or more people send
consistent, unwanted, and often threatening electronic messages to someone else.

Identity Theft also called Identity Fraud is a crime that is being committed by a huge number
nowadays. Identity theft happens when someone steals your personal information to commit
fraud.

Cyber Defamation
Cyber Defamation is defaming someone by harming their public image and reputation in the
digital space.
Types of Cyber Defamation
1. Online Trolling
2. Social Media Stalking and Harassment
3. Unauthorized AI deep Fakes
4. Posting False, Misleading Information About the Victim
5. Circulating the Victim's Photo or Name in Offensive Memes

Prof. Somwanshi A.A. ( Arrow Computer Academy ) : - 8788335443