LESSON 39
Web Security
The nature of the internet makes it vulnerable to attack. Estimates claim that there are over 300
million computers connected via the Internet. Originally designed to allow for the freest possible
exchange of information, it is widely used today for commercial purposes. This poses significant
security problems for organizations when protecting their information assets. For example,
hackers and virus writers try to attack the Internet and computers connected to the Internet.
Some want to invade others’ privacy and attempt to crack into databases of sensitive information
or sniff information as it travels across Internet routes.
The concept of Web
The Internet Protocol is designed solely for the addressing and routing of data packets across a
network. It does not guarantee or provide evidence on the delivery of messages. There is no
verification of an address. The sender will not know if the message reaches its destination at the
time it is required. The receiver does not know if the message came from the address specified as
the return address in the packet. Other protocols correct some of these drawbacks.
39.1 Web Security Threats
There is two major classes of security threats
•Passive Attacks
•Active Attacks
39.2 Passive attacks
This class of network attacks involves probing for network information. These passive attacks can
lead to actual active attacks or intrusions/penetrations into an organization’s network. By probing
for network information, the intruder obtains network information as that can be used to target a
particular system or set of systems during an actual attack.
Types of Passive attacks
Examples of passive attacks that gather network information include the following:
•Network Analysis
•Eavesdropping
•Traffic Analysis
39.3 Active Attacks
Once enough network information has been gathered, the intruder will launch an actual attack
against a targeted system to either gain complete control over that system or enough control to
cause certain threats to be realized. This may include obtaining unauthorized access to modify data
or programs, causing a denial of service, escalating privileges, accessing other systems. They affect
the integrity, availability and authentication attributes of network security.
39.4 Types of Active attacks
Common form of active attacks may include the following:
•Masquerading – involves carrying out unauthorized activity by impersonating a legitimate
docsity.com
