3. Ms. Ashwini Vaykole (Roll No. 04) has completed the case study of Internet Security satisfactorily during academic year 2010-11.

4. Date: 28th August, 2010

5. Professor-in-charge

7. OR

9. OR

11. A security policy should be economically feasible, understandable, realistic, consistent, procedurally tolerable, and also provide reasonable protection relative to the stated goals and objectives of management.

12. OR

14. The policy should specify the mechanism through which these requirements can be met

17. They must be enforceable with security tools, where appropriate, and with sanctions, where actual prevention is not technically feasible.

18. They must clearly define the areas of responsibility for the users, administrators, and management.

20. Securing the prime, host machines by logically isolating them. In most situations, the network is not the resource at risk rather; it is the endpoint of the network that is threatened.

21. Usually, there are bugs in the program for networks or in the administrator of the system.

22. It is this way with computer security; the attacker just has to trust them in some fashion. It might be therefore a major risk that the intruder can compromise the entire system.

23. He will now be able to attack other systems, either by taking over root, and thence the system’s identity, or by taking over some user account. This is called transitive trust.

24. Authentication of user

25. It provides checking the identity of valid users keeping the unauthorized user away.

26. Choosing good password & protecting them

27. A good password should be developed using various criteria and safeguarding it as well. Also making sure it is not reuse and change frequently.

28. Using firewall & proxy servers

29. These firewall and proxy servers are act like a logical security guard to monitor traffic in and out of your local network and the internet.

30. A firewall is a collection of components placed between two networks that have the following properties

31. All traffic from inside to outside and from outside to inside must passed through firewall

32. Only authorized traffic refund by local security policy will be allow to pass

33. For firewall login NIS (Network Interface System) not necessary

34. It gives protection administration

35. It helps in security without disturbing a population of users

37. A DMZ is an example of general philosophy of defense in depth. That is multiple layers of security always provide better shield. If an attacker penetrates past the first firewall he or she gains access to the DMZ, but not necessarily to the internal network. Without the DMZ, the first successful penetration could result in a more serious compromise.

38. Making use of encryption techniques

39. It is used to encrypt the sensitive information to be sent out making it harder to crack if intercepted

40. Encryption is often consider as the ultimate weapon in the computer security

41. Encryption is based to safe guard file transmission if a key is generated from a type password

42. There are various encryption techniques like symmetric and asymmetric

44. Computer Technology Purchasing Guidelines, which specify required, or preferred security features. Theses should supplement existing purchasing policies and guidelines.

45. A Privacy Policy, which defines reasonable expectations of privacy regarding such issues as monitoring of electronic mail, logging of keystrokes, and access to users files.

46. An Access policy, which defines access rights and privileges to protect assets from loss or disclosure by specifying acceptable use guidelines for external connections, operation staff, and management. It should provide guidelines for external connections, data communication, connecting devices to a network, and adding new software to systems. It should also specify any required notification messages (e.g., connect messages should provide warnings about authorized usage and line monitoring, and adding simply say “Welcome”).

47. An Accountability Policy, which defines the responsibilities of users, operation staff, and management. It should specify an audit capability, and provide incident handling guidelines (i.e., what to do and who to contact if a possible intrusion is detected).

48. An Authentication Policy establishes trust through an effective password policy, and by setting guidelines for remote location authentication and the use of authentication devices (e.g., one-time password and devices that generate them).

49. An Availability statement which sets users expectations for the availability of resources. It should address redundancy and recovery issues, as well as specify operating hours and maintenance downtime periods. It should also include contact information for reporting system and network failures.

50. An Information Technology System and Network Maintenance Policy which describes how both internal and external maintenance people are allowed to handle and access technology. One important topic to be addressed here is whether remote maintenance is allowed and how such access is controlled. Another area for consideration here is outsourcing and how it is managed.

51. A Violation Reporting Policy that indicates which types of violations (e.g., privacy and security, internal and external) must be reported and to whom the reports are made. A non-treating atmosphere and the possibility of anonymous reporting will result in a greater probability that a violation will be reported if it is detected.

53. Department within the university etc.)

54. Security incident response team

55. Representative of the user groups affected by the security policy

56. Responsible management

57. Legal counsel(if appropriate)

59. Before a security policy is set up the following points should be considered

60. Finding out what resources you want to protect

61. The resources you want to protect may include Physical resources like printers, monitors, keyboards, drives, modems etc. and Logical resources include source and object program, data utilities, operating system, application etc.

62. What resources you are trying to protect

63. The answer to this is will dictate the host specific measures that are needed. Machines with sensitive files may require extra security measures. Stronger the authentication, keystrokes logging and strict auditing, or even file encryption. If the target of interest is the outgoing connectivity, the administrator may choose to require certain privileges for access to the network.

64. Find out who can disrupt them and in what ways

65. Physical threats to the resources such as stealing, malfunctioning devices.

66. Logical threats such as unauthorized access to data, information, resources.

67. Unintended disclosure of your information.

68. Who is interested in attacking you

69. Outsiders as well as insiders may from the collective answers here.

70. What kind of security therefore must be provided differs from the type of attacker you are planning against.

71. How much security can you afford

72. Part of cost of security is directed financial expenditures, such as extra routes, firewalls, software packages, and so on. Often, the administrative costs are overlooked. There is another cost, however a cost in convenience and productivity, and even moderate. Too much security, people get frustrated. Finding the proper balance therefore essential.

73. What stance do you stake?

75. In a technological era, Computer Security is fundamental to individual privacy. A great deal of personal information is stored on computer. If these computers are not safe prying eyes, neither is the data they hold. Worse yet, some of the most sensitive data-credit histories, bank balances, and the like-lives on machines attached to very large networks.

76. It is a fair school of thought that “I have a right to attack others because someone else has attack me!” No it is not ethical to do so! How can you take the law in your hands? This cannot be treated as “self defense”. Can it be?

77. Computer Security is a matter of good manners. If people want to be left alone, they should be.

78. More and more modem society depends on computers, and on the integrity of the programs and data they contain. These range from obvious (finance industry) to the telephone industry controlled by bugs in such systems can be divesting.

79. The administrator may gain some knowledge, some information about the users, about the organization, by the virtue of his position. Using such information for personal gain is not ethical.