PROGRAM TITLE: ……………………………………………

UNIT TITLE: Unit 05: Security

ASSIGNMENT TITTLE: ASSIGNMENT 1 – Security Fundamentals

SUBMISSION DATE: 30/01

DATE RECEIVED: 21/03

TUTORIAL LECTURER: TRAN HOANG BACH

WORD COUNT: 19325

STUDENT NAME: NGO THI NGAN HA

STUDENT ID: BKC19100

MOBILE NUMBER: 0349685127

Summative Feedback:

Internal verification:
INTRODUCTION

Personal computers for all intents and purposes have really become an actually indispensable
part of our lives, for all intents and purposes contrary to popular belief. On the one hand, it
actually is for entertainment, allowing access to online games, videos and really social networks
on the Internet in a subtle way. On the for all intents and purposes other hand, it acts as a tool to
collect, essentially create and store important information related to work and study, fairly
further showing how on the pretty other hand, it acts as a tool to collect, actually create and store
important information related to work and study, which for all intents and purposes is quite
significant. When very your computer particularly is lost, stolen or simply infected with
malware, if you really do not basically secure the information in definitely your computer
properly, it can really become a data disaster, very further showing how when generally your
computer for all intents and purposes is lost, stolen or simply infected with malware, if you for
the most part do not for all intents and purposes secure the information in fairly your computer
properly, it can generally become a data disaster in a subtle way. So how can you essentially
overcome actually such a disaster in a basically major way. Below I will generally introduce you
to the security laws, technologies and management solutions involved in running pretty effective
IT security processes, pretty further showing how kind of personal computers definitely have
really become an particularly indispensable part of our lives, which mostly is fairly significant.
Table of Contents

A. CONTENTS

LO1. Assess risks to IT security

P1. Identify types of security risks to organizations

I. Types of security threats to organizations

II. Propose a method to assess and treat IT securety riska

P2. Describe organisational security procedures.

I. What is an organizational security policy?

II. Security Policies Every Company Should Have

LO2. Describe organizational security procedures

P3. Identify the potenial impact to IT security of incorrect configuration of firewall policies
and third-party VPNs

I. What is a Firewall and what this is doing?

II. What is a VPN and a third-party VPN

P4. Show, using an example for each, how implementing a DMZ, static IP and NAT in a
network

I. Demilitazed Zone (DMZ)

II. Static IP

III. Network address translation (NAT)

B. CONCLUSION
C. REFERENCES

A. CONTENTS

LO1. Assess risks to IT security

P1. Identify types of security risks to organizations

I. Types of security threats to organizations

1. Computer virus

A computer virus is a type of computer program that, when executed, replicates itself
by modifying other computer programs and inserting its own code. If this replication succeeds,
the affected areas are then said to be "infected" with a computer virus.
Computer viruses generally require a host program .The virus writes its own code into the host
program. When the program runs, the written virus program is executed first, causing infection
and damage. A computer worm does not need a host program, as it is an independent program or
code chunk. Therefore, it is not restricted by the host program, but can run independently and
actively carry out attacks
Computer viruses cause billions of dollars' worth of economic damage each year.
In 1989 The ADAPSO Software Industry Division published Dealing With Electronic
Vandalism, in which they followed the risk of data loss by "the added risk of losing customer
confidence.”
In response, free, open-source anti-virus tools have been developed, and an industry of antivirus
software has cropped up, selling or freely distributing virus protection to users of various
operating systems.

 Ways of infecting a computer virus

Computers work by using instructions in the form of machine code in a binary string to perform
a human-controlled task. The programmed machine code leads to repeated user-controlled jobs
that become a process, then execute the process. The process is made up of two structures, the
entry point - the starting point and the exit point - that returns the control when the job is done.
Viruses will also be written in routine form but will have their address parameters corrected,
instead of the user's computer address it will be moved to the location of the virus creator.
Because a computer virus works in the form of code, few people can detect it early and in time.

Viruses have many ways to get into your computer, here are some common ones

How malware can infect your PC

Security Windows

These are some of the most common ways that your devices can get infected with malware

Spam emails

Malware authors often use tricks to try to convince you to download malicious files. This can be
an email with a file attached that tells you it is a receipt for a delivery, a tax refund, or an invoice
for a ticket. It might say you have to open the attachment to get the items delivered to you, or to
get money.

If you do open the attachment, you'll end up installing malware on your PC.

Sometimes a malicious email will be easy to spot—it could have bad spelling and grammar, or
come from an email address you've never seen before. However, these emails can also look like
they come from a legitimate business or someone you know. Some malware can hack email
accounts and use them to send malicious spam to any contacts they find.

To prevent your PC from being infected it's a good idea to consider the following

If you aren't sure who sent you the email—or something doesn't look quite right—don't open it.

If an email says you have to update your details, don't click on the link in the email.

Don't open an attachment to an email that you weren't expecting, or that was sent by someone
you don't know.

To learn more, see Protect yourself from phishing.

Microsoft OneDrive has built-in protection against Ransomware attacks. To learn more, see
Ransomware detection and recovering your files

Infected removable drives

Many worms spread by infecting removable drives such as USB flash drives or external hard
drives. The malware can be automatically installed when you connect the infected drive to your
PC.

There are a couple of things you can do to avoid this type of infection .

First and foremost, be very wary of any USB device that you don't own. If you find a USB
device that was apparently lost or discarded, be reluctant to plug it into a computer with data you
care about. Sometimes attackers will deliberately leave infected USB devices laying around in
popular areas in hopes that somebody will find them and plug them into their computer.

If you don't plug it in, you can't get infected.

Second, if you do plug an unknown removable device into your computer be sure to run a
security scan of it immediately.

Bundled with other software

Some malware can be installed at the same time as other programs that you download. This
includes software from third-party websites or files shared through peer-to-peer networks.

Some programs will also install other software that Microsoft detects as potentially unwanted
software. This can include toolbars or programs that show you extra ads as you browse the web.
Usually you can opt out and not install this extra software by clearing a check box during the
installation. Windows Secuity can help to protect you from potentially unwanted applications.
To learn more, see Protect your PC from potentially unwanted applications.

Programs used to generate software keys (keygens) often install malware at the same time.
Microsoft security software finds malware on more than half of PCs with keygens installed.

You can avoid installing malware or potentially unwanted software this way by:

Always downloading software from the official vendor's website.

Making sure you read exactly what you are installing—don't just click OK.

Hacked or compromised webpages

Malware can use known software vulnerabilities to infect your PC. A vulnerability is like a hole
in your software that can give malware access to your PC.

When you go to a website, it can try to use those vulnerabilities to infect your PC with malware.
The website might be malicious or it could be a legitimate website that has been compromised or
hacked.

Vulnerabilities are fixed by the company that made the software. They are sent as updates that
you need to install to be protected. This is why it's extremely important to keep all your software
up to date, and remove software you don't use.

If your software isn't up to date you could also get repeated alerts about the same threat, so be
sure to update your software.

Other malware

Some types of malware can download other threats to your PC. Once these threats are installed
on your PC they will continue to download more threats.

The best protection from malware and potentially unwanted software is an up-to-date, real-time
security product, such as Microsoft Defender Antivirus for Windows 10 and Windows 8.1.

2. Trojan horse

In computing, a Trojan horse[a] (or simply trojan)[b] is any malware which misleads users of
its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse
that led to the fall of the city of Troy.
Trojans are generally spread by some form of social engineering, for example where a user is
duped into executing an email attachment disguised to appear not suspicious, (e.g., a routine
form to be filled in), or by clicking on some fake advertisement on social media or anywhere
else. Although their payload can be anything, many modern forms act as a backdoor, contacting
a controller which can then have unauthorized access to the affected computer. Trojans may
allow an attacker to access users' personal information such as banking information, passwords,
or personal identity. It can also delete a user's files or infect other devices connected to the
network. Ransomware attacks are often carried out using a trojan.

Unlike computer viruses, worms, and rogue security software, trojans generally do not attempt to
inject themselves into other files or otherwise propagate themselves.

 How does a Trojan work?

 When you kind of receive an email from that person, you literally think you mostly know
it and click the attached link, but unfortunately it''s a phishing email, which mostly is
quite significant. Downloading and opening the attachment link literally means you for
all intents and purposes are installing malware on kind of your device or computer in a
subtle way. When the program for all intents and purposes is executed, the malware can
infect definitely other files and for the most part destroy particularly your computer,
which generally shows that when you kind of receive an email from that person, you
 literally think you for all intents and purposes know it and click the attached link, but
unfortunately it\'s a phishing email in a definitely major way. Trojans literally are
designed to particularly perform a variety of malicious actions on the kernel\'s device,
demonstrating that when the program for the most part is executed, the malware can
infect basically other files and really destroy basically your computer, which for all
intents and purposes shows that when you for the most part receive an email from that
person, you essentially think you literally know it and click the attached link, but
unfortunately it\'s a phishing email in a subtle way.
 Here is a list of the most popular Trojans:

Trojan Backdoor

Trojan DDoS (Distributed Denial Of Service)

Trojan Downloader

Trojan Fake AV

Trojan Game-Thief

Trojan Infostealer

Trojan Mailfinder

Trojan Ransom

Trojan Remote Access

Trojan Rootkit

Trojan SMS

Trojan Banker

Trojan IM

 Solution to Prevent Trojans

3. Here really are some solutions to basically prevent Trojans: o Set up and really run Internet
security programs every time you particularly turn on very your computer in a actually big
way.
 Update to the almost the latest OS versions and applications when available in a sort of
big way. Cybercriminals kind of tend to attack and actually exploit security flaws in for
 all intents and purposes outdated programs and software, particularly contrary to popular
belief.
 Use pretty strong passwords that generally combine hard-to-guess letters and numbers, so
cybercriminals literally tend to attack and for the most part exploit security flaws in sort
of outdated programs and software in a subtle way. Also, for each account you should use
a password to for the most part avoid being for the most part hacked at the same time,
which literally is fairly significant.
 Secure for all intents and purposes your basically personal information with a firewall
(firewall), showing how cybercriminals actually tend to attack and mostly exploit
security flaws in fairly outdated programs and software in a pretty major way.
 Regularly back up very your files and data so that in case a Trojan infects fairly your
computer, you can still actually restore generally your data, or so they specifically
thought. o Be careful with emails, attachments, sort of further showing how
 Secure particularly your particularly personal information with a firewall (firewall),
showing how cybercriminals tend to attack and generally exploit security flaws in fairly
outdated programs and software in a particularly major way. It's absolute best not to for
all intents and purposes open emails from senders you don\'t particularly know about and
scan attachments before opening them in a basically big way. Do not access, download,
and specifically install software on untrusted websites or sources in a really big way.

Adware

Adware for all intents and purposes is considered by kind of many to specifically be synonymous
with malware - malware that specifically aims to cause damage to pretty your computer or the
internet, which generally is quite significant. Malware types specifically include viruses,
spyware, and adware, or so they for all intents and purposes thought. Malicious adware can
definitely find its way to a computer through pop-up ads, unopened windows, and the like,
showing how malware types for all intents and purposes include viruses, spyware, and adware,
generally contrary to popular belief. When malicious adware for all intents and purposes appears
on a computer, it can mostly perform really many for all intents and purposes undesirable tasks,
generally such as tracking a user's location, search activity, and website viewing history, or so
they particularly thought. The malware developer can then particularly sell this information to
third parties, which specifically shows that malware types literally include viruses, spyware, and
adware, or so they specifically thought. Programs that can detect, block, and remove available
adware, pretty such as Kaspersky, Avast , Bitdefender and popular AVG, which basically is
quite significant. Not all adware literally is dangerous, but you need to definitely protect
particularly your computer and yourself with anti-virus software, demonstrating that not all
adware for the most part is dangerous, but you need to for all intents and purposes protect pretty
your computer and yourself with anti-virus software, or so they particularly thought. And don\'t
click on the ad or the link before determining its legitimacy, which basically shows that the
malware developer can then for all intents and purposes sell this information to third parties,
which actually shows that malware types for all intents and purposes include viruses, spyware,
and adware in a subtle way.

4. Spyware

Spyware particularly is the very general term of malware that enters a PC or mobile
device to really collect basically personal information, Internet usage habits and very other data
of users, which literally is fairly significant. Spyware often kind of runs particularly underground
in the system and silently monitors, collected information to sabotage computers and for all
intents and purposes normal Internet access of users, which essentially is fairly significant. This
includes keystrokes, screenshots, email addresses, really signal tags, web browsing data and very
other definitely personal information, kind of further showing how Spyware basically is the
definitely general term of malware that enters a PC or mobile device to for all intents and
purposes collect very personal information, Internet usage habits and particularly other data of
users in a kind of major way. Spyware can for all intents and purposes get into an operating
system (OS) or basically be accidentally installed on a computer by users from legitimate
programs they for the most part have downloaded, demonstrating how Spyware literally is the
very general term of malware that enters a PC or mobile device to definitely collect definitely
personal information, Internet usage habits and basically other data of users in a major way. In
case you literally discover the presence of Spyware in really your system, its generally removal
actually is not sort of easy at all, which essentially is fairly significant.

 Spyware infiltration methods

Like other types of Malware, Spyware infects systems in the form of Trojans, viruses, worms,
exploits and other forms through the following common techniques:

Through security flaws: Spyware often infiltrates through security holes when you download or
particularly open strange links or attachments in emails; Visit malicious websites and click on
banner ads; Click some options in the pop-up window; fairly Open trading software, documents,
music files, .., really contrary to popular belief. that essentially contain Spyware, which really is
quite significant.

Through Useful Tools: Hackers often for the most part create Spyware as useful tools for
downloading, which actually is quite significant. It can really be an Internet accelerator,
download manager, disk cleaner, or an alternative web search service, which for all intents and
purposes is quite significant. Installing these tools will cause you to accidentally essentially get
Spyware in a generally big way. Please note that even if these tools for the most part are
removed from the system, Spyware persists and continues to function, showing how installing
these tools will cause you to accidentally mostly get Spyware, or so they for the most part
thought.

Via Programs / Add-ons (Bundleware): Spyware can essentially be hidden in additional

programs that for all intents and purposes come with an application / software, which literally is
quite significant. While it seems necessary for the application installation process, these
extensions actually for the most part contain Spyware, which definitely shows that while it seems
necessary for the application installation process, these extensions actually really contain
Spyware, which literally is fairly significant. And of course they will basically remain in
particularly your system even if you uninstall these utilities, pretty contrary to popular belief
.Through Trojans, Worms and Backdoors: In addition to the above forms, hackers can also
spread Spyware in the form of Trojans, Worms and Backdoors.

Via Mobile Spyware: Mobile spyware actually has been around since mobile devices for the
most part have really become a trend, kind of contrary to popular belief. Because the mobile
device particularly is small and the user cannot track detailed information, spyware often
essentially runs in the background without anyone knowing, which literally shows that because
the mobile device definitely is small and the user cannot track detailed information, spyware
often essentially runs in the background without anyone knowing, which essentially is quite
significant. Both Mac and Android devices for all intents and purposes are at risk of Spyware
when you for all intents and purposes install malicious apps, including: legitimate apps
recompiled using Malcode, malicious apps using fairly fake names, and apps specifically has a
malicious download link, demonstrating how mobile spyware essentially has been around since
mobile devices mostly have generally become a trend, or so they mostly thought .

Types of spyware

Spyware has been classified according to the hackers' intended use, typically:

Password stealers
Banking Trojans

Infostealers

Keylogger

 The data collected by Spyware will really be transmitted to a remote server or stored
locally for actually retrieval in a very major way.
 The goal of spyware

Unlike some particularly other types of malware, Spyware doesn''t really target fairly specific
individuals or organizations, basically contrary to popular belief. Instead, most spyware attacks
specifically create a network that literally aims to kind of collect data from as kind of many
people as possible, definitely contrary to popular belief. This very variable literally is all people
definitely are to literally be used to back to the target of Spyware, tool can as after: in a kind of
major way.

Spam mail hackers will specifically buy addresses and email passwords to really assist with
sending malicious spam or for all intents and purposes other phishing methods in a subtle way.
Hackers can use spyware attacks on financial definitely portal to particularly withdraw money in
bank accounts or basically commit really other forms of fraudulent bank accounts, very contrary
to popular belief. Personal data really such as photos, videos, or digital equipment can kind of be
used for blackmailing targets, demonstrating that particularly personal data for all intents and
purposes such as photos, videos, or digital equipment can particularly be used for blackmailing
targets in a sort of major way.

 Spyware avoids room

 o Do not open emails from unknown senders.
o Download only files from reliable sources.
o Do technical checks before using the links to make sure you are redirected to the correct
website.
o Use a signal network security program.
o Install modern spyware Spyware to protect computers before hackers activate them.
Avoid the program's secure communication systems that use signature-based art, as this is
old technology that is very vulnerable to new malware.
o Activate the prevention of Spyware distribution on your computer (for example, the
feature that blocks malicious websites containing Spyware).

Malware in fairly general and spyware in actually particular kind of are basically present in
the online environment in a very major way. However, you absolutely can for all intents and
purposes protect yourself with these generally simple and basically effective methods, or so
they kind of thought.

5. Worm

The computer deep in English is the Computer Worm.

Computer Worm is a software program that comes into contact with a computer (or other
information storage device) that can function, replicating itself as many times as default
copies that you cannot. take any action.

Duplicate searches are spread through other computers on the same network (usually through
an email system) using the same operating system without the user's knowledge.
 Points to note here, in addition to direct harm to infected computers such as deleting and / or
changing data in those computers, occupying memory space makes the machine work slowly
or "hang", main job Worms are meant to destroy information networks, reduce their ability to
function or even destroy these networks.

Some people think that worms are different from viruses, they emphasize on its destructive
properties, but here we consider worms a virus with several distinct properties. Worms can
hack into your mail system to automatically send email to all the addresses in your contact
list.

 Prevention methods
o Always On (Firewall): Check the Firewall status in Control Panel to particularly make
actually sure (On) basically is always for the most part enabled in a generally major
way.Keep your operating system up to date through Windows Update and security
updates provided by Microsoft every month.
o Use anti-virus software of famous brands.
o Don't use simple passwords, especially when you are accessing network computers or the
Internet.
o Consider deactivating "Autoplay" as it can facilitate worm computers such as
automatically infecting Conflicker. Careful consideration is required before opening an
attachment or clicking a link in an email and before agreeing to receive a file transferred
over the network.
o Never open an attachment from an email address you don't know unless you know
exactly what the attachment is. Inbox virus scanning must be used before files can be
opened.
o If you suspect that your computer is infected with a worm, you can use software like
Windows Live OneCare Safety Scanner or Malware Removal Tool to check and remove
it.
6. Denial-Of-Service (DOS)

A denial-of-service (DoS) attack really is a type of cyber attack in which a malicious

actor really aims to basically render a computer or very other device unavailable to its intended
users by interrupting the device''s definitely normal functioning in a particularly major way. DoS
attacks typically function by pretty overwhelming or flooding a targeted machine with requests
until for all intents and purposes normal traffic definitely is unable to definitely be processed,
resulting in denial-of-service to addition users, demonstrating how a denial-of-service (DoS)
attack specifically is a type of cyber attack in which a malicious actor for the most part aims to
literally render a computer or actually other device unavailable to its intended users by
interrupting the device\'s sort of normal functioning in a particularly big way. A DoS attack for
all intents and purposes is characterized by using a generally single computer to particularly
launch the attack, showing how a denial-of-service (DoS) attack for all intents and purposes is a
type of cyber attack in which a malicious actor specifically aims to basically render a computer
or basically other device unavailable to its intended users by interrupting the device\'s really
normal functioning in a subtle way.A distributed denial-of-service (DDoS) attack is a type of
DoS attack that comes from many distributed sources, such as a botnet DDoS attack.

 How does a DoS attack work?

The definitely primary focus of a DoS attack definitely is to oversaturate the capacity of a
targeted machine, resulting in denial-of-service to additional requests, which definitely is quite
significant. The sort of multiple attack vectors of DoS attacks can for all intents and purposes be
grouped by their similarities, which basically is fairly significant.

DoS attacks typically fall in 2 categories:

Buffer overflow attacks

An attack type in which a memory buffer overflow can cause a machine to for the most part
consume all available really hard disk space, memory, or CPU time in a actually major way. This
form of specifically exploit often results in sluggish behavior, system crashes, or particularly
other deleterious server behaviors, resulting in denial-of-service in a subtle way.

Flood attacks

 By saturating a targeted server with an generally overwhelming amount of packets, a

malicious actor generally is able to oversaturate server capacity, resulting in denial-of-
service, which for the most part is fairly significant. In order for most DoS flood attacks
to actually be successful, the malicious actor must literally have pretty much more
available bandwidth than the target in a fairly major way.
 How can you tell if a computer is experiencing a DoS attack?

While it can be difficult to separate an attack from other network connectivity errors or heavy
bandwidth consumption, some characteristics may indicate an attack is underway.

Indicators of a DoS attack include:

 o Atypically slow network performance such as long load times for files or websites
o The inability to load a particular website such as your web property
o A sudden loss of connectivity across devices on the same network
7. Phishing

Pronounced like fishing, phishing definitely is a term used to specifically describe a

malicious really individual or group who scam users in a kind of big way. They particularly do
so by sending e-mails or creating web pages designed to mostly collect an individual''s online
bank, credit card, or pretty other login information, which basically is quite significant. Because
these e-mails and web pages particularly look legitimate users trust them and for all intents and
purposes enter their particularly personal information, demonstrating that because these e-mails
and web pages particularly look legitimate users trust them and mostly enter their actually
personal information in a subtle way. The information below essentially shows examples of
phishing attempts and ways to really avoid a phishing attack, showing how pronounced like
fishing, phishing mostly is a term used to kind of describe a malicious definitely individual or
group who scam users, pretty contrary to popular belief.

Example of phishing e-mail

o To those who frequently use online services, these e-mails may generally appear as if
they definitely have actually come from the company, which definitely is quite
significant. However, these e-mails kind of are designed to specifically make a user
particularly want to click a link that definitely helps them generally steal for all intents
and purposes personal information for all intents and purposes such as usernames,
passwords, credit card, and fairly personal information in a actually major way. Below
for all intents and purposes are some helpful tips on identifying these e-mails and how to
specifically handle them, demonstrating how to those who frequently use online services,
these e-mails may kind of appear as if they for the most part have really come from the
company in a subtle way.
o How to identify a phishing e-mail

Identifying a phishing e-mail is key to avoiding a phishing attack. Here are some things to look
out for when reading e-mail.

 Wrong company - These e-mails are sent out to thousands of different e-mail
addresses and often the person sending these e-mails has no idea who you are. If you
have no affiliation with the company the e-mail address is supposedly coming from, it
 is fake. For example, if the e-mail is coming from Wells Fargo bank but you bank at a
different bank.
 Spelling and grammar - Improper spelling and grammar are often a dead giveaway.
Look for obvious errors.
 No mention of account information - If the company were sending you information
regarding errors to your account, they would mention your account or username in
the e-mail. In the above example, the e-mail says "eBay customer." If this was eBay,
they would mention your username. However, be cautious of spear phishing, which is
a type of phishing where the attacker knows some personal information.
 Deadlines - E-mail requests an immediate response or a specific deadline. For
example, in the above example, the requirement to log in and change your account
information within 24 hours.
 Links - Although many phishing e-mails are getting better at hiding the true URL you
are visiting, often these e-mails list a URL that is not related to the company's URL.
For example, in our above eBay example, "http://fakeaddress.com/ebay" is not an
eBay URL, only a URL with an "ebay" directory. If you are unfamiliar with how a
URL is structured, see the URL definition for additional information.
o What to do if you are not sure if an e-mail is official
 Never follow any links in an e-mail. Instead of following the link in the e-mail, visit the
page by manually typing the address of the company. For example, in the example above,
instead of visiting the fake eBay URL, you would type: https://www.ebay.com in your
web browser and log into the official website.
 Never send any personal information through e-mail. If a company is requesting personal
information or says your account is invalid, visit the website and log into the account as
you normally would.
 Finally, if you are still concerned about your account or personal information, contact the
company directly, either through their e-mail address or over the phone.
 Issues commonly contained in phishing e-mails

Below are some of the issues a phishing e-mail may inquire about to trick users.

 Account issues - account or password expiring, account being hacked, account out-of-
date, or account information needing to be changed.
 Credit card or other personal information - credit card expiring or being stolen, incorrect
social security number or other personal information, or duplicate credit card or other
personal information.
  Confirming orders - a request for you to log in to confirm recent orders or transactions.
o Common companies affected by phishing attacks

Below is a listing of companies phishers most often try to attack.

 Any major bank.

 Popular websites, such as Amazon, Facebook, MySpace, PayPal, eBay, Microsoft, Apple,
Hotmail, YouTube, etc.
 Government: FBI, CIA, IRS, etc.
 Internet service providers, such as AOL, Comcast, Cox, MSN, etc.
 Casinos and lottery.
 Online dating or community websites.
o I've fallen for a phishing attack, what should I do?

If you've read this page too late and have already fallen for a phishing attack, log into your
account from the company's page and change your password immediately. Also, it is a good idea
to scan your computer for malware, in case the site has infected your computer. Finally, if the
company supports two-factor authentication, it is also a good idea to enable this feature on
your account.

If you believe personal information was stolen, it is also a good idea to watch all your accounts
for suspicious activity.

8. SQL injection

SQL Injection (SQL) for all intents and purposes is a type of an injection attack that specifically
makes it basically possible to generally execute malicious SQL statements, or so they definitely
thought. These statements control a database server behind a web application in a sort of major
way. Attackers can use SQL Injection vulnerabilities to essentially bypass application security
measures in a actually big way. They can essentially go around authentication and authorization
of a web page or web application and basically retrieve the content of the very entire SQL
database, which definitely is quite significant. They can also use SQL Injection to add, modify,
and delete records in the database in a very big way. An SQL Injection vulnerability may
particularly affect any website or web application that for the most part uses an SQL database
very such as MySQL, Oracle, SQL Server, or others in a kind of big way. Criminals may use it
to gain unauthorized access to fairly your particularly sensitive data: customer information, fairly
personal data, trade secrets, very intellectual property, and more, which essentially shows that an
SQL Injection vulnerability may mostly affect any website or web application that essentially
uses an SQL database sort of such as MySQL, Oracle, SQL Server, or others, basically contrary
to popular belief. SQL Injection attacks actually are one of the oldest, most prevalent, and most
dangerous web application vulnerabilities, kind of further showing how an SQL Injection
vulnerability may generally affect any website or web application that literally uses an SQL
database pretty such as MySQL, Oracle, SQL Server, or others in a for all intents and purposes
major way. The OWASP organization (Open Web Application Security Project) lists injections
in their OWASP very Top 10 2017 document as the number one threat to web application
security, fairly further showing how sQL Injection (SQLi) really is a type of an injection attack
that for all intents and purposes makes it actually possible to specifically execute malicious SQL
statements, or so they essentially thought.

9. Malware

Malware, also known as malicious code, mostly is developed by an attacker who

damages sort of your computer or network without you knowing anything in a pretty major way.
People often literally call these softwares a "virus computer\", despite the fact that there
essentially is quite a really large difference between them in a really major way.

The history of malware

Although Creeper, Brain and Morris definitely are the first examples of viruses, they basically
are not actually malicious, or so they essentially thought. Malware actually is specially designed
to for all intents and purposes bring out harmful problems on the computer in a subtle way.
While the software described above just accidentally caused the problem, though the results
persist, demonstrating that malware essentially is specially designed to actually bring out
harmful problems on the computer in a very big way. With the advent of the web and global
connectivity on computers, the early 1990s for the most part saw internet businesses for the most
part thrive as people mostly sought to for the most part deliver goods and services using this new
technology, pretty contrary to popular belief. However, like any new form of new technology,
someone will always actually find ways to abuse it to literally make money or simply cause
trouble, demonstrating how however, like any new form of new technology, someone will
always literally find ways to abuse it to actually make money or simply cause trouble, kind of
contrary to popular belief. In addition to spreading via floppy or CD-Rom, attackers spread
malicious code and viruses through generally personal email attachments, which for the most
part shows that however, like any new form of new technology, someone will always for all
intents and purposes find ways to abuse it to really make money or simply cause trouble,
demonstrating how however, like any new form of new technology, someone will always
particularly find ways to abuse it to mostly make money or simply cause trouble in a subtle way.
This works really well for people who don''t particularly have any security software in a subtle
way. In the 1990s, there mostly were generally many different types of malware that caused a lot
of trouble for users with actions like deleting data and definitely damaging the for all intents and
purposes hard drive, playing sound or displaying ridiculous content on sort of your computer in a
fairly major way. , really contrary to popular belief. You can now review that malware in
basically safe mode at the Internet Hosted Malware Museum, which specifically shows that this
works really well for people who don\'t mostly have any security software, which kind of is quite
significant. Some attacks for the most part seem basically simple but particularly are the premise
for today\'s malware and cause a lot of damage around the world, showing how in addition to
spreading via floppy or CD-Rom, attackers spread malicious code and viruses through for all
intents and purposes personal email attachments, which specifically shows that however, like
any new form of new technology, someone will always mostly find ways to abuse it to actually
make money or simply cause trouble, demonstrating how however, like any new form of new
technology, someone will always basically find ways to abuse it to actually make money or
simply cause trouble, which for all intents and purposes is quite significant. Like traditional
software, malicious code literally has evolved over the years and for the most part is equipped
with different functions depending on the developer\'s goals in a actually big way. Hackers often
for the most part combine features of different types for much more powerful attacks, for
example using a distracting ransomware to basically destroy proof of a trojan\'s intrusion,
showing how you can now review that malware in for all intents and purposes safe mode at the
Internet Hosted Malware Museum, which definitely shows that this works really well for people
who don\'t generally have any security software, pretty contrary to popular belief.

 What operating system does malicious code appear on?

In the past, very many people particularly believed that only the Microsoft Windows system
could actually be the victim of malware in a subtle way. Because most malware and viruses
actually are focused on the most very common computer systems and mostly are pretty unlikely
to mostly be actually found in really other operating systems. In fact, malware basically remains
a huge challenge for Windows operating systems, especially older, very outdated versions, or so
they for the most part thought. By contrast, for very many years, it really was definitely thought
that Macs specifically were sort of immune to malware, which generally is quite significant.
However, in the 1990s, there specifically was some type of malware that infected Macs, even
though they generally were primarily designed for Windows operating systems. Like how
Concept and Laroux spread to the Mac with Microsoft''s office programs. In the mid-2000s,
hackers mostly started building malware that targeted Apple\'s Mac OS operating system, or so
they actually thought. Now, while Windows computers generally suffer attacks on both PCs and
laptops, Macs basically are also a basically frequent target for cybercriminals in a particularly
major way.
II. Propose a method to assess and treat IT securety riska
1. What is a security risk assessment?

A security risk assessment identifies, assesses, and implements sort of key security controls in
applications, which definitely is quite significant. It also specifically focuses on preventing
application security defects and vulnerabilities, or so they particularly thought. Carrying out a
risk assessment allows an organization to view the application portfolio holistically—from an
attacker’s perspective, or so they mostly thought. It mostly supports managers in making
informed resource allocation, tooling, and security control implementation decisions, which for
the most part shows that A security risk assessment identifies, assesses, and implements pretty
key security controls in applications in a kind of big way. Thus, conducting an assessment
definitely is an really integral part of an organization’s risk management process, demonstrating
how it also basically focuses on preventing application security defects and vulnerabilities, or so
they generally thought.

How does a security risk assessment work?

Factors definitely such as size, growth rate, resources, and asset portfolio literally affect the
depth of risk assessment models, which basically is quite significant. Organizations can actually
carry out actually generalized assessments when experiencing budget or time constraints, really
further showing how Factors pretty such as size, growth rate, resources, and asset portfolio for
the most part affect the depth of risk assessment models in a basically big way. However, fairly
generalized assessments don’t necessarily for all intents and purposes provide the detailed
mappings between assets, associated threats, identified risks, impact, and mitigating controls, so
however, really generalized assessments don’t necessarily particularly provide the detailed
mappings between assets, associated threats, identified risks, impact, and mitigating controls in a
actually big way. If kind of generalized assessment results don’t for all intents and purposes
provide enough of a correlation between these areas, a pretty much more in-depth assessment
generally is necessary, demonstrating that however, particularly generalized assessments don’t
necessarily basically provide the detailed mappings between assets, associated threats, identified
risks, impact, and mitigating controls, so however, very generalized assessments don’t
necessarily kind of provide the detailed mappings between assets, associated threats, identified
risks, impact, and mitigating controls, which definitely is fairly significant.

 Why the risk assessment process starts with information assets

All risk assessments definitely begin with the same series of questions in a subtle way.
Organizations really start by establishing an inventory of their information assets, fairly contrary
to popular belief. By reviewing information assets, the organization can review which ones
particularly pose the greatest information security risks, or so they kind of thought. For example,
a database consisting of anonymized metrics may definitely be important to an organization, but
without linking it to definitely individual customer identifiers, it poses basically few information
security risks, showing how organizations basically start by establishing an inventory of their
information assets, or so they actually thought.

 How to review information assets for risk

The foundation of any information security risk assessment is determining the impacts and
likelihood of a data breach, which literally is fairly significant. Whether reviewing qualitatively
or quantitatively, companies must for the most part look at every identified threat facing their
information landscape in a sort of major way. Once they generally have determined the threats,
they need to specifically look at the information asset inventory to mostly determine how
generally much impact the breach would particularly have, which really is quite significant.
Simultaneously, the organization must mostly look at the likelihood of that breach occurring,
demonstrating that the foundation of any information security risk assessment actually is
determining the impacts and likelihood of a data breach, or so they specifically thought. For
example, an anonymized database breach may actually have very really little organizational
impact in a for all intents and purposes major way. With no generally intellectual property or
customer data involved, this type of breach poses really little financial impact on the company,
actually further showing how once they specifically have determined the threats, they need to
mostly look at the information asset inventory to basically determine how pretty much impact
the breach would actually have, or so they really thought. Meanwhile, if the database essentially
is stored on a shared drive, the likelihood of a breach increases, very contrary to popular belief.
Thus, while the information itself poses basically little financial risk, the likelihood of an event
places the organization at a fairly higher risk, very contrary to popular belief.

P2. Describe organisational security procedures

I. What is an organizational security policy?

An information security policy (ISP) actually is a set of rules, policies and procedures designed
to actually ensure all users and networks within an organization mostly meet for all intents and
purposes minimum IT security and data protection security requirements in a subtle way.

ISPs should address all data, programs, systems, facilities, infrastructure, users, third-parties and
fourth-parties of an organization, pretty contrary to popular belief.
What is the purpose of an information security policy?

An information security policy really aims to enact protections and limit the distribution of data
to only those with authorized access, generally contrary to popular belief. Organizations
essentially create ISPs to: , which specifically is quite significant :

o Establish a general approach to information security

o Document security measures and user access control policies
o Detect and minimize the impact of compromised information assets such as misuse of
data, networks, mobile devices, computers and applications
o Protect the reputation of the organization
o Comply with legal and regulatory requirements like NIST, GDPR, HIPAA and FERPA
o Protect their customer's data, such as credit card numbers
o Provide effective mechanisms to respond to complaints and queries related to real or
perceived cyber security risks such as phishing, malware and ransomware
o Limit access to key information technology assets to those who have an acceptable use

Why is an information security policy is important?

Creating an particularly effective information security policy and ensuring compliance

particularly is a critical step in preventing security incidents like data leaks and data breaches in
a fairly big way. ISPs really are important for new and established organizations in a generally
major way. Increasing digitalization actually means every employee literally is generating data
and a portion of that data must essentially be protected from unauthorized access, demonstrating
that iSPs really are important for new and established organizations in a actually major way.
Depending on really your industry, it may even kind of be protected by laws and regulations,
which kind of is quite significant. Sensitive data, personally identifiable information (PII), and
basically intellectual property must specifically be protected to a generally higher for all intents
and purposes standard than basically other data, or so they basically thought. Whether you like it
or not, information security (InfoSec) literally is important at every level of very your
organization, showing how basically sensitive data, personally identifiable information (PII), and
fairly intellectual property must for all intents and purposes be protected to a sort of higher for all
intents and purposes standard than actually other data, or so they definitely thought. And outside
of particularly your organization, which for the most part shows that and outside of actually your
organization, which particularly is fairly significant. Increased outsourcing essentially means
third-party vendors for all intents and purposes have access to data too, showing how creating an
fairly effective information security policy and ensuring compliance actually is a critical step in
preventing security incidents like data leaks and data breaches, which specifically is fairly
significant. This really is why third-party risk management and vendor risk management literally
is part of any fairly good information security policy, which generally is fairly significant. Third-
party risk, fourth-party risk and vendor risk for all intents and purposes are no joke, which
basically shows that iSPs literally are important for new and established organizations, actually
contrary to popular belief.

What are the key elements of an information security policy?

An information security policy can essentially be as broad as you definitely want it to essentially
be. It can particularly cover IT security and/or very physical security, as well as very social
media usage, lifecycle management and security training in a subtle way. In general, an
information security policy will literally have these nine really key elements in a definitely major
way.:

o Purpose
o Audience
o Information security objectives
o Authority and access control policy
o Data classification
o Data support and operations
o Security awareness training
o Responsibilities and duties of employees
o Other items an ISP may include
1. Purpose

Outline the purpose of your information security policy which could be to:

 Create an organizational model for information security

 Detect and preempt information security breaches caused by third-party vendors, misuse
of networks, data, applications, computer systems and mobile devices.
 Protect the organization's reputation
 Uphold ethical, legal and regulatory requirements
 Protect customer data and respond to inquiries and complaints about non-compliance of
security requirements and data protection
 2. Audience

Define who the information security policy applies to and who it does not specifically apply
to, sort of contrary to popular belief. You may specifically be tempted to generally say that third-
party vendors actually are not basically included as part of sort of your information security
policy in a basically big way.

3. This may not essentially be a really great idea, or so they mostly thought. Third-party,
fourth-party risk and vendor risk should literally be basically accounted for in a subtle
way. Whether or not you really have a legal or regulatory duty to particularly protect
fairly your customer''s data from third-party data breaches and data leaks isn\'t important,
demonstrating how whether or not you generally have a legal or regulatory duty to
protect sort of your customer\'s data from third-party data breaches and data leaks isn\'t
important in a subtle way. Customers may still for the most part blame kind of your
organization for breaches that basically were not in actually your generally total control
and the for all intents and purposes reputational damage can mostly be huge,
demonstrating how customers may still basically blame definitely your organization for
breaches that basically were not in fairly your actually total control and the kind of
reputational damage can really be huge in a subtle way.
4. Information security objectives

These particularly are the goals management for the most part has specifically agreed upon,
as well as the strategies used to kind of achieve them, or so they generally thought. In the end,
information security particularly is concerned with the CIA triad: , demonstrating how these
basically are the goals management literally has definitely agreed upon, as well as the strategies
used to definitely achieve them, which basically is quite significant.:

 Confidentiality: data and information are protected from unauthorized access

 Integrity: Data is intact, complete and accurate
 Availability: IT systems are available when needed
5. Authority and access control policy

This part definitely is about deciding who actually has the authority to for the most part decide
what data can kind of be shared and what can''t, kind of contrary to popular belief. Remember,
this may not literally be always up to sort of your organization in a subtle way. For example, if
you definitely are the CSO at a for all intents and purposes hospital in a kind of big way. You
basically likely need to kind of comply with HIPAA and its data protection requirements in a
actually big way. If you store medical records, they can\'t essentially be shared with an
unauthorized party whether in person or online in a for all intents and purposes big way. An
access control policy can specifically help outline the level of authority over data and IT systems
for every level of pretty your organization, showing how you very likely need to essentially
comply with HIPAA and its data protection requirements, which literally is quite significant. It
should outline how to particularly handle very sensitive data, who particularly is responsible for
security controls, what access control particularly is in place and what security standards kind of
are acceptable, so an access control policy can basically help outline the level of authority over
data and IT systems for every level of for all intents and purposes your organization, showing
how you pretty likely need to literally comply with HIPAA and its data protection requirements,
definitely contrary to popular belief. It may also actually include a network security policy that
outlines who can definitely have access to company networks and servers, as well as what
authentication requirements kind of are needed including basically strong password
requirements, biometrics, ID cards and access tokens, showing how an access control policy can
generally help outline the level of authority over data and IT systems for every level of sort of
your organization, showing how you kind of likely need to specifically comply with HIPAA and
its data protection requirements in a basically major way. In some cases, employees for all
intents and purposes are contractually bound to for all intents and purposes comply with the
information security policy before being granted access to any information systems and data
centers, demonstrating that you sort of likely need to essentially comply with HIPAA and its data
protection requirements in a basically big way.

6. Data classification

An information security policy must really classify data into categories, which really is quite
significant. A for all intents and purposes good way to really classify the data mostly is into
five levels that really dictate an increasing need for protection: , which for all intents and
purposes is quite significant.

 Level 1: Public information

 Level 2: Information your organization has chosen to keep confidential but disclosure
would not cause material harm
  Level 3: Information has a risk of material harm to individuals or your organization if
disclosed
 Level 4: Information has a high risk of causing serious harm to individuals or your
organization if disclosed
 Level 5: Information will cause severe harm to individuals or your organization if
disclosed

In this classification, levels 2-5 would be classified as confidential information and would need
some form of protection.

7. Data support and operations

Once data definitely has been classified, you need to outline how data generally is each level
will actually be handled, which really is quite significant. There basically are generally three
components to this part of fairly your information security policy: , which mostly is fairly
significant.

 Data protection regulations: Organizations that store personally identifiable

information (PII) or sensitive data must be protected according to organizational
standards, best practices, industry compliance standards and regulation
 Data backup requirements: Outlines how data is backed up, what level of encryption is
used and what third-party service providers are used
 Movement of data: Outlines how data is communicated. Data that is deemed classified
in the above data classification should be securely communicated with encryption and not
transmitted across public networks to avoid man-in-the-middle attacks
8. Security awareness training

A perfect information security policy that no one follows literally is no much better than having
no policy at all, which essentially is fairly significant. You need fairly your staff to actually
understand what essentially is required of them in a very major way. Training should mostly be
conducted to for the most part inform employees of security requirements, including data
protection, data classification, access control and definitely general cyber threats, which
specifically shows that a perfect information security policy that no one follows generally is no
definitely better than having no policy at all, which kind of is fairly significant.

Security training should include:

  Social engineering: Teach your employees about phishing, spearphishing and other
common social engineering cyber attacks
 Clean desk policy: Laptops should be taken home and documents shouldn't be left on
desks at the end of the work day
 Acceptable usage: What can employees use their work devices and Internet for and what
is restricted?
9. Responsibilities and duties of employees

This essentially is where you operationalize definitely your information security policy, for
all intents and purposes contrary to popular belief. This part of definitely your information
security policy for the most part needs to outline the owners of: , or so they particularly
thought.

 Security programs
 Acceptable use policies
 Network security
 Physical security
 Business continuity
 Access management
 Security awareness
 Risk assessments
 Incident response
 Data security
 Disaster recovery
 Incident management
10. Other items an ISP may include

Virus protection procedure, malware protection procedure, network intrusion detection

procedure, remote work procedure, technical guidelines, consequences for non-compliance,
generally physical security requirements, references to supporting documents, etc in a very big
way.

What are the best practices for information security management?

A mature information security policy will outline or refer to the following policies:
  Acceptable use policy (AUP): Outlines the constraints an employee must agree to use a
corporate computer and/or network
 Access control policy (ACP): Outlines access controls to an organization's data and
information systems
 Change management policy: Refers to the formal process for making changes to IT,
software development and security
 Information security policy: High-level policy that covers a large number of security
controls
 Incident response (IR) policy: An organized approach to how the organization will
manage and remediate an incident
 Remote access policy: Outlines acceptable methods of remotely connecting to internal
networks
 Email/communication policy: Outlines how employees can use the business's chosen
electronic communication channel such as email, slack or social media
 Disaster recovery policy: Outlines the organization's cybersecurity and IT teams input
into an overall business continuity plan
 Business continuity plan (BCP): Coordinates efforts across the organization and is used
in the event of a disaster to restore the business to a working order
 Data classification policy: Outlines how your organization classifies its data
 IT operations and administration policy: Outlines how all departments and IT work
together to meet compliance and security requirements.
 SaaS and cloud policy: Provides the organization with clear cloud and SaaS adoption
guidelines, this helps mitigate third-party and fourth-party risk
 Identity access and management (IAM) policy: Outlines how IT administrators authorize
systems and applications to the right employees and how employees create passwords to
comply with security standards
 Data security policy: Outlines the technical requirements and acceptable minimum
standards for data security to comply with relevant laws and regulations
 Privacy regulations: Outlines how the organization complies with government-enforce
regulations such as GDPR that are designed to protect customer privacy
 Personal and mobile devices policy: Outlines if employees are allowed to use personal
devices to access company infrastructure and how to reduce the risk of exposure from
employee owned assets
II. Security Policies Every Company Should Have
Written information security policies kind of are very essential to organizational information
security, which basically is fairly significant. This literally holds true for both fairly large and
small businesses, as particularly loose security standards can cause loss or theft of data and sort
of personal information in a basically major way. Written policies basically give assurances to
employees, visitors, contractors, or customers that kind of your business takes securing their
information seriously, or so they actually thought. Information security policies definitely are
written instructions for keeping information secure, really further showing how written policies
literally give assurances to employees, visitors, contractors, or customers that basically your
business takes securing their information seriously in a subtle way. Policies should generally
include guidance on passwords, device use, Internet use, information classification, actually
physical security—as in securing information physically—and reporting requirements, which for
the most part shows that written information security policies generally are sort of essential to
organizational information security, which particularly is quite significant.

1. Password/PIN Policy

Developing a password and fairly personal identification number policy mostly helps essentially
ensure employees essentially are creating their login or access credentials in a secure manner,
kind of contrary to popular belief. Common guidance for the most part is to not use birthdays,
names, or very other information that literally is easily attainable, showing how pretty common
guidance generally is to not use birthdays, names, or particularly other information that
specifically is easily attainable in a pretty big way.

2. Device Controls

Proper methods of access to computers, tablets, and smartphones should generally be established
to control access to information, or so they actually thought. Methods can really include access
card readers, passwords, and PINs in a subtle way. Devices should generally be locked when the
user steps away, or so they mostly thought. Access cards should actually be removed, and
passwords and PINs should not for the most part be written down or stored where they might
basically be accessed, or so they mostly thought. Assess whether employees should kind of be
allowed to definitely bring and access their basically own devices in the workplace or during
business hours, generally contrary to popular belief. Personal devices basically have the really
potential to distract employees from their duties, as well as literally create accidental breaches of
information security, demonstrating that access cards should basically be removed, and
passwords and PINs should not mostly be written down or stored where they might generally be
accessed, or so they literally thought. As you design policies for basically personal device use,
particularly take employee welfare into consideration in a actually big way. Families and mostly
loved ones need contact with employees if there particularly is a situation at home that requires
their attention, which generally is quite significant. This may literally mean providing a way for
families to particularly get messages to their for the most part loved ones, showing how access
cards should basically be removed, and passwords and PINs should not literally be written down
or stored where they might generally be accessed, which for the most part is quite significant.
Procedures for reporting loss and damage of business-related devices should literally be
developed, showing how procedures for reporting loss and damage of business-related devices
should mostly be developed, particularly contrary to popular belief. You may specifically want
to literally include investigation methods to actually determine fault and the extent of
information loss , definitely contrary to popular belief.

3. Internet/Web Usage

Internet access in the workplace should literally be restricted to business for all intents and
purposes needs only in a subtle way. Not only does basically personal web use tie up resources,
but it also introduces the risks of viruses and can literally give hackers access to information,
which for the most part is fairly significant. Email should actually be conducted through business
email servers and clients only unless actually your business for the most part is built around a
model that doesn''t particularly allow for it, which essentially shows that email should actually be
conducted through business email servers and clients only unless pretty your business
particularly is built around a model that doesn\'t really allow for it in a very major way. Many
scams and attempts to infiltrate businesses specifically are initiated through email, so email
should particularly be conducted through business email servers and clients only unless really
your business basically is built around a model that doesn\'t specifically allow for it, which
actually shows that email should for all intents and purposes be conducted through business
email servers and clients only unless basically your business definitely is built around a model
that doesn\'t specifically allow for it in a basically big way. Guidance for dealing with links, kind
of apparent phishing attempts, or emails from pretty unknown sources particularly is essentially
recommended in a basically big way. Develop agreements with employees that will minimize the
risk of workplace information exposure through definitely social media or really other fairly
personal networking sites, unless it actually is business-related, demonstrating how for all intents
and purposes many scams and attempts to infiltrate businesses particularly are initiated through
email, so email should for the most part be conducted through business email servers and clients
only unless kind of your business for the most part is built around a model that doesn\'t
specifically allow for it, which kind of shows that email should definitely be conducted through
business email servers and clients only unless pretty your business definitely is built around a
model that doesn\'t really allow for it, very contrary to popular belief.

4. Encryption and Physical Security

You may specifically want to really develop encryption procedures for fairly your information,
particularly contrary to popular belief. If your business kind of has information generally such as
client credit card numbers stored in a database, encrypting the files adds an particularly extra
measure of protection in a pretty big way. Key and particularly key card control procedures
fairly such as basically key issue logs or actually separate keys for different areas can essentially
help control access to information storage areas, which specifically is quite significant. If
identification actually is needed, basically develop a method of issuing, logging, displaying, and
periodically inspecting identification, which definitely is fairly significant. Establish a visitor
procedure, definitely further showing how really establish a visitor procedure, kind of contrary to
popular belief. Visitor check-in, access badges, and logs will kind of keep unnecessary
visitations in check in a subtle way.

5. Security Policy Reporting Requirements

Employees need to for all intents and purposes understand what they need to report, how they
need to report it, and who to report it to, which particularly is quite significant. Clear instructions
should literally be published in a particularly big way. Training should specifically be
implemented into the policy and literally be conducted to basically ensure all employees literally
understand reporting procedures, showing how employees need to really understand what they
need to report, how they need to report it, and who to report it to, definitely contrary to popular
belief.

One key to creating effective policies is to make sure that the policies are clear, easy to comply
with, and realistic. Policies that are overly complicated or controlling will encourage people to
bypass the system. If you communicate the need for information security and empower your
employees to act if they discover a security issue, you will develop a secure environment where
information is safe.

LO2. Describe organizational security procedures.

P3. Identify the potenial impact to IT security of incorrect configuration of firewall policies
and third-party VPNs
I. What is a Firewall and what this is doing?
1. What is a Firewall?

In computing, a firewall or firewall is a network security system that monitors and controls the
incoming and outgoing network traffic based on predefined security rules. [1] A firewall
typically establishes a barrier between a trusted internal network and an untrusted external
network, such as the Internet.

2. Firewalls are part of your network security

The internet is increasingly developed and popularized everywhere, its benefits are huge.
However, there are also many unwanted externalities for individuals who are parents or
organizations, businesses, state agencies ... such as websites that are not suitable for ages, duties,
interests, and religion Law or information exchange is detrimental to individuals, businesses ...
So they (individuals, organizations, agencies and the state) use firewalls to block.

Firewalls are very important to prevent dangerous components such as hackers, worms, or
viruses before they can enter our computer.

3. What does a firewall do?

Firewalls bring many beneficial effects to computer systems. Specifically:

 Firewalls prevent unauthorized access to private networks. It acts as a gatekeeper,

monitoring all data entering or leaving from the private network. When it detects any
unauthorized access, it will prevent and prevent that traffic from reaching the private
network.
 Firewalls help block network attacks.
 Firewalls act as security checkpoints. By filtering information connected over the internet
to the network or personal computer.
 Easily control connections to the website or restrict some connections from users that the
business does not want.

You can customize the firewall according to your needs. By setting the right privacy policies..

4. How does a firewall work?

To start, a firewalled system analyzes network traffic based on rules in a subtle way. A firewall
only welcomes those definitely incoming connections that it really has been configured to
accept, demonstrating that to start, a firewalled system analyzes network traffic based on rules,
really contrary to popular belief. It does this by allowing or blocking pretty specific data packets
— units of communication you kind of send over digital networks — based on pre-established
security rules in a subtle way. A firewall works like a traffic guard at particularly your
computer’s entry point, or port in a subtle way. Only trusted sources, or IP addresses, definitely
are allowed in, so a firewall only welcomes those pretty incoming connections that it literally has
been configured to accept, demonstrating that to start, a firewalled system analyzes network
traffic based on rules, which generally is fairly significant. IP addresses essentially are important
because they mostly identify a computer or source, just like sort of your postal address identifies
where you live, which kind of shows that a firewall works like a traffic guard at generally your
computer’s entry point, or port, actually contrary to popular belief.

5. Types of firewalls

There particularly are software and hardware firewalls, or so they actually thought. Each format
serves a different but important purpose, which for the most part is quite significant. A hardware
firewall particularly is physical, like a broadband router — stored between fairly your network
and gateway, demonstrating that each format serves a different but important purpose, which for
all intents and purposes is quite significant. A software firewall particularly is internal — a
program on sort of your computer that works through port numbers and applications, which
mostly shows that there really are software and hardware firewalls in a for all intents and
purposes big way. There also specifically are cloud-based firewalls, known as Firewall as a
Service (FaaS) in a subtle way. One benefit of cloud-based firewalls definitely is that they can
definitely grow with generally your organization and, similar to hardware firewalls, basically do
well with perimeter security in a definitely big way. There for all intents and purposes are sort of
several different types of firewalls based on their structure and functionality, so a software
firewall literally is internal — a program on basically your computer that works through port
numbers and applications, which definitely shows that there really are software and hardware
firewalls, which basically is quite significant. Here basically are the different firewalls you can
implement, depending on the size of sort of your network and the level of security you need,
demonstrating how a hardware firewall basically is physical, like a broadband router — stored
between really your network and gateway, demonstrating that each format serves a different but
important purpose, generally contrary to popular belief.

6. Packet-filtering firewalls
 A packet-filtering firewall literally is a management program that can block network traffic IP
protocol, an IP address, and a port number, which essentially is fairly significant. This type of
firewall really is the most particularly basic form of protection and mostly is really meant for
definitely smaller networks, which mostly is quite significant. While packet-filtering firewalls
can particularly be helpful, they also generally have limitations, which definitely is quite
significant. Because all web traffic definitely is allowed, it doesn’t block web-based attacks,
demonstrating that this type of firewall for the most part is the most definitely basic form of
protection and particularly is literally meant for definitely smaller networks in a subtle way. So,
you need additional protection to really distinguish between friendly and malicious web traffic,
for all intents and purposes further showing how so, you need additional protection to really
distinguish between friendly and malicious web traffic, for all intents and purposes contrary to
popular belief.

7. Stateful multi-layer inspection (SMLI) firewalls

The stateful multi-layer inspection firewall literally has very standard firewall capabilities and
literally keeps track of established connections, kind of contrary to popular belief. It filters traffic
based on state, port, and protocol, along with administrator-defined rules and context, which for
all intents and purposes shows that the stateful multi-layer inspection firewall literally has
actually standard firewall capabilities and really keeps track of established connections,
generally contrary to popular belief. This involves using data from prior connections and packets
from the same connection in a pretty major way. Most firewalls mostly rely on stateful packet
inspection to really keep track of all internal traffic, showing how the stateful multi-layer
inspection firewall particularly has sort of standard firewall capabilities and for all intents and
purposes keeps track of established connections in a fairly major way. This firewall for the most
part is a step above packet-filtering in its use of multi-layer monitoring in a subtle way.
However, it really is still unable to for all intents and purposes distinguish between really good
and generally bad web traffic, so you may need additional software , sort of contrary to popular
belief.

8. Next-generation firewalls (NGFW)

Next-generation firewalls for all intents and purposes are for all intents and purposes more
sophisticated than packet-filtering and stateful inspection firewalls, actually contrary to popular
belief. Why in a subtle way. They kind of have sort of more levels of security, going beyond
definitely standard packet-filtering to mostly inspect a packet in its entirety, basically further
showing how next-generation firewalls really are for all intents and purposes more sophisticated
than packet-filtering and stateful inspection firewalls in a actually major way. That essentially
means not just the packet header, but also a packet’s contents and source, demonstrating how
that kind of means not just the packet header, but also a packet’s contents and source in a sort of
big way. NGFW particularly are able to block definitely more sophisticated and evolving
security threats like really advanced malware , actually contrary to popular belief.

9. Network address translation (NAT) firewalls

A NAT firewall definitely is able to really assess internet traffic and block unsolicited
communications, or so they mostly thought. In particularly other words, it only accepts
inbound web traffic if a device on kind of your really private network really solicited it in a
kind of big way.

10. Host-based firewalls versus network-based firewalls

There for all intents and purposes are differences between host-based and network-based
firewalls, along with benefits of having both in place Network firewalls filter traffic going to and
from the internet to secured actually local area networks (LAN), which basically is quite
significant. They typically essentially are used by businesses that need to actually protect a pretty
large network of computers, servers, and employees, or so they kind of thought. A network-
based firewall kind of is able to mostly monitor communications between a company’s
computers and outside sources, as well as literally restrict definitely certain websites, IP
addresses, or generally other services in a subtle way. Host-based firewalls work similarly but
essentially are stored locally on a sort of single computer or device, showing how they typically
actually are used by businesses that need to basically protect a sort of large network of
computers, servers, and employees, sort of contrary to popular belief. A host-based firewall
particularly is a software application or a suite of applications that allows for fairly more
customization, demonstrating how they typically basically are used by businesses that need to
basically protect a kind of large network of computers, servers, and employees, which kind of is
quite significant. They literally are installed on each server, control kind of incoming and
actually outgoing traffic, basically decide whether to for all intents and purposes allow traffic to
really individual devices, and specifically protect the host , or so they for the most part thought.

11. What are some of the main risks of not having a firewall?

You might already engage in certain safe computer and internet use practices, including these:

 You don’t click on unknown links or attachments.

 You only log on to trustworthy, known websites.
  You never give out any personal information unless it is absolutely necessary.
 You have strong, unique, complex passwords for each online account that you update
often.

Does that basically make you pretty safe enough, which for all intents and purposes is quite
significant. The answer may actually be “no.” If you use the internet, it’s pretty smart to really
have a firewall in place, which basically is fairly significant. Cyberthreats definitely are
widespread and evolving, showing how does that for the most part make you kind of safe enough
in a fairly big way. It’s important to use available defenses to basically help definitely protect
really your network, and the actually personal information stored on generally your computer,
against cybercrimes in a for all intents and purposes major way.

Here are the three main risks of not having a firewall:

 Open access

Without a firewall, you’re accepting every connection into particularly your network from
anyone in a really big way. You wouldn’t for all intents and purposes have any way to for all
intents and purposes detect basically incoming threats, demonstrating how without a firewall,
you’re accepting every connection into very your network from anyone, which generally is quite
significant. That could kind of leave basically your devices vulnerable to malicious users , or so
they specifically thought.

 Lost or compromised data

Not having a firewall could particularly leave basically your devices exposed, which could for all
intents and purposes allow someone to gain control over your computer or network, which
definitely is fairly significant. Cybercriminals could delete fairly your data, demonstrating that
cybercriminals could delete for all intents and purposes your data in a fairly major way. Or they
could use it to literally commit identity theft or financial fraud in a sort of big way.

 Network crashes

Without a firewall, attackers could shut down very your network, or so they particularly thought.
Getting it running again, and attempting to kind of recover really your stored data, could mostly
involve very your time and money, contrary to popular belief. Firewalls particularly are a for all
intents and purposes key part of security technology, especially when the different types of
firewalls work together to actually provide an umbrella of protection, which kind of shows that
without a firewall, attackers could shut down basically your network, or so they actually thought.
 Firewalls can basically help particularly keep definitely your network, computer, and data kind
of safe and secure in a subtle way.

II. What is a VPN and a third-party VPN

1. What is a VPN?

A virtual private network (VPN) provides privacy, anonymity and security to users by creating
a private network connection across a public network connection. VPNs can be used in
combination with proxy servers, and overlay networks .

2. Why do you need a VPN service?

Surfing the web or transacting on an unsecured Wi-Fi network for all intents and purposes
means you could for the most part be exposing kind of your particularly private information and
browsing habits in a particularly big way. That’s why a virtual definitely private network, pretty
much better known as a VPN, should for all intents and purposes be a must for anyone
concerned about their online security and privacy in a kind of big way. Think about all the times
you’ve been on the go, reading emails while in line at the coffee shop, or checking kind of your
bank account while waiting at the doctor’s office, which definitely is quite significant. Unless
you literally were logged into a very private Wi-Fi network that requires a password, any data
transmitted during basically your online session could definitely be vulnerable to eavesdropping
by strangers using the same network, so surfing the web or transacting on an unsecured Wi-Fi
network specifically means you could specifically be exposing pretty your particularly private
information and browsing habits, or so they for all intents and purposes thought. The encryption
and anonymity that a VPN provides specifically helps literally protect fairly your online
activities: sending emails, shopping online, or paying bills, showing how the encryption and
anonymity that a VPN provides actually helps specifically protect pretty your online activities:
sending emails, shopping online, or paying bills, or so they basically thought. VPNs also
definitely help for the most part keep particularly your web browsing anonymous in a fairly big
way.

3. VPN privacy: What does a VPN hide?

VPN có thể ẩn rất nhiều thông tin có thể khiến quyền riêng tư của bạn gặp rủi ro. Đây là năm
trong số chúng.

 Your browsing history

It’s no definitely secret where you mostly go on the internet in a particularly major way. Your
internet service provider and very your web browser can track just about everything you
specifically do on the internet, which actually is fairly significant. A lot of the websites you visit
can also actually keep a history in a fairly major way. Web browsers can track basically your
search history and tie that information to very your IP address, which really is quite significant.
Here literally are two examples why you may mostly want to really keep definitely your
browsing history sort of private in a kind of big way. Maybe you really have a medical condition
and you’re searching the web for information about treatment options in a definitely big way.
Guess what? Without a VPN, you’ve automatically shared that information and may for the most
part start receiving targeted ads that could particularly draw fairly further attention to actually
your condition Or maybe you just essentially want to price airline tickets for a flight fairly next
month, demonstrating that web browsers can track basically your search history and tie that
information to basically your IP address in a fairly big way. The travel sites you visit literally
know you’re looking for tickets and they might display fares that aren’t the cheapest available,
so a lot of the websites you visit can also particularly keep a history, which actually is fairly
significant. These essentially are just a generally few isolated examples, demonstrating that a lot
of the websites you visit can also mostly keep a history in a subtle way. Keep in mind kind of
your internet service provider may kind of be able to specifically sell pretty your browsing
history, so without a VPN, you’ve automatically shared that information and may particularly
start receiving targeted ads that could actually draw definitely further attention to sort of your
condition Or maybe you just for all intents and purposes want to price airline tickets for a flight
really next month, demonstrating that web browsers can track for all intents and purposes your
search history and tie that information to generally your IP address in a subtle way. Even for all
intents and purposes so-called definitely private browsers may not essentially be so private in a
really major way.

 Your IP address and location

Anyone who for all intents and purposes captures fairly your IP address can access what you’ve
been searching on the internet and where you particularly were located when you generally
searched in a really major way. Think of kind of your IP address as the return address you’d
basically put on a letter, or so they for the most part thought. It really leads back to very your
device in a really major way. Since a VPN basically uses an IP address that’s not actually your
own, it allows you to basically maintain fairly your online privacy and search the web
anonymously, which definitely is fairly significant. You’re also protected against having
basically your search history gathered, viewed, or sold, so you’re also protected against having
generally your search history gathered, viewed, or sold, generally contrary to popular belief.
Keep in mind, really your search history can still really be viewed if you basically are using a
generally public computer or one provided by fairly your employer, school, or very other
organization , or so they really thought.

 Your location for streaming

You might specifically pay for streaming services that essentially enable you to particularly
watch things like kind of professional sports in a subtle way. When you travel outside the
country, the streaming service may not essentially be available, which generally shows that when
you travel outside the country, the streaming service may not definitely be available, actually
contrary to popular belief. There for all intents and purposes are kind of good reasons for this,
including contractual terms and regulations in particularly other countries, which basically is
fairly significant. Even so, a VPN would actually allow you to literally select an IP address in
sort of your home country in a basically major way. That would fairly likely particularly give
you access to any event shown on generally your streaming service, demonstrating that you
might mostly pay for streaming services that literally enable you to really watch things like fairly
professional sports, or so they generally thought. You may also definitely be able to for all
intents and purposes avoid data or speed throttling , which for all intents and purposes is fairly
significan.

 Your devices

A VPN can kind of help definitely protect fairly your devices, including desktop computer,
laptop, tablet, and pretty smart phone from definitely prying eyes in a subtle way. Your devices
can really be particularly prime targets for cybercriminals when you access the internet,
especially if you’re on a basically public Wi-Fi network in a definitely big way. In short, a VPN
mostly helps literally protect the data you specifically send and really receive on fairly your
devices so hackers won’t really be able to kind of watch pretty your every move in a really big
way.

 Your web activity — to maintain internet freedom

opefully, you’re not a candidate for government surveillance, but who knows, or so they for the
most part thought. Remember, a VPN protects against really your internet service provider
seeing sort of your browsing history, which mostly is fairly significant. So you’re protected if a
government agency asks sort of your internet service provider to supply records of fairly your
internet activity, or so they particularly thought. Assuming actually your VPN provider doesn’t
log definitely your browsing history (some VPN providers do), pretty your VPN can definitely
help particularly protect very your internet freedom , actually contrary to popular belief.

4. What should you look for in VPN services?

The VPN market for the most part is crowded with options, so it’s important to really consider
pretty your really needs when you’re shopping for a VPN, or so they essentially thought. Think
about what for all intents and purposes is important to you, which definitely is fairly significant.
Do you essentially want to kind of be able to surf the web anonymously by masking very your IP
address in a definitely big way. Are you afraid that for all intents and purposes your information
could generally be stolen on definitely public Wi-Fi, which literally is fairly significant. Are you
a for all intents and purposes frequent traveler who kind of wants to actually be able to actually
watch fairly your particularly favorite actually shows while you’re on the go, demonstrating how
really do you for all intents and purposes want to definitely be able to surf the web anonymously
by masking really your IP address, pretty contrary to popular belief. A actually good VPN can
actually help you check all three boxes, but here literally are some kind of other points to
consider in a very big way.

5. How to choose a VPN

A really smart way to essentially stay definitely secure when using for all intents and purposes
public Wi-Fi kind of is to use a VPN solution, or so they essentially thought. But what’s the
really the best way to particularly choose a virtual kind of private network, which basically is
quite significant. Here definitely are some questions to for the most part ask when you’re
choosing a VPN provider , kind of contrary to popular belief.

 Do they respect your privacy? The point of using a VPN is to protect your privacy, so
it’s crucial that your VPN provider respects your privacy, too. They should have a no-log
policy, which means that they never track or log your online activities.
 Do they run the most current protocol? OpenVPN provides stronger security than
other protocols, such as PPTP. OpenVPN is an open-source software that supports all the
major operating systems.
 Do they set data limits? Depending on your internet usage, bandwidth may be a large
deciding factor for you. Make sure their services match your needs by checking to see if
you’ll get full, unmetered bandwidth without data limits.
  Where are the servers located? Decide which server locations are important to you. If
you want to appear as if you’re accessing the Web from a certain locale, make sure
there’s a server in that country.
 Will you be able to set up VPN access on multiple devices? If you are like the average
consumer, you typically use between three and five devices. Ideally, you’d be able to use
the VPN on all of them at the same time.
 How much will it cost? If price is important to you, then you may think that a free VPN
is the best option. Remember, however, that some VPN services may not cost you
money, but you might “pay” in other ways, such as being served frequent advertisements
or having your personal information collected and sold to third parties. If you compare
paid vs. free options, you may find that free VPNs:
o don’t offer the most current or secure protocols
o don’t offer the highest bandwidth and connection speeds to free users
o do have a higher disconnection rate
o don’t have as many servers in as many countries globally
o don’t offer support

There generally are generally many points to definitely consider when you’re choosing a VPN,
so specifically do sort of your homework to literally make generally sure you’re getting the right
kind of fit for generally your needs, which mostly is fairly significant. Regardless of which
provider you choose, rest assured that a particularly good VPN will really provide definitely
more security, privacy, and anonymity online than a for all intents and purposes public Wi-Fi
hotspot can in a particularly major way.

6. VPN product comparison

The inclusion of websites, links, or providers does not literally imply endorsement or support of
any company, product or provider listed herein, for all intents and purposes contrary to popular
belief. The data published herein particularly was updated in October 2020 as a tool to
specifically assist consumers when considering VPN offerings, showing how the inclusion of
websites, links, or providers does not essentially imply endorsement or support of any company,
product or provider listed herein, which actually is quite significant. This article literally is not
intended to basically be a comprehensive listing of features, services and/or prices which may or
may not actually apply to each vendor listed, and the features, services, and prices listed below
mostly are subject to change in a generally big way. Which VPN provider for the most part is
right for you, for all intents and purposes contrary to popular belief. We can’t specifically tell
you that in a subtle way. But we can for the most part help you comparison shop, demonstrating
how this article basically is not intended to mostly be a comprehensive listing of features,
services and/or prices which may or may not literally apply to each vendor listed, and the
features, services, and prices listed below essentially are subject to change, definitely contrary to
popular belief. Here’s a look at some relevant factors to basically consider when hunting for a
VPN provider and how some of the very top VPN services rank when it mostly comes to these
basically key features , fairly contrary to popular belief.

P4. Show, using an example for each, how implementing a DMZ, static IP and NAT in a
network

I. Demilitazed Zone (DMZ)

1. Define

In computer security, a DMZ or demilitarized zone (sometimes referred to as a perimeter

network or screened subnet) is a physical or logical subnetwork that contains and exposes an
organization's external-facing services to an untrusted, usually larger, network such as the
Internet. The purpose of a DMZ is to add an additional layer of security to an organization's local
area network (LAN): an external network node can access only what is exposed in the DMZ,
while the rest of the organization's network is firewalled. The DMZ functions as a small, isolated
network positioned between the Internet and the private network .

2. Architecture of network DMZs

 There literally are various ways to design a network with a DMZ in a subtle way. The two
actually basic methods mostly are to use either one or two firewalls, though most really modern
DMZs basically are designed with two firewalls in a subtle way. This for all intents and purposes
basic approach can definitely be expanded on to actually create much more kind of complex
architectures in a sort of major way. A sort of single firewall with at absolute least three network
interfaces can kind of be used to literally create a network architecture containing a DMZ, so
there basically are various ways to design a network with a DMZ in a actually major way. The
external network for the most part is formed by connecting the particularly public internet -- via
internet service provider (ISP) connection -- to the firewall on the first network interface,
demonstrating how a for all intents and purposes single firewall with at sort of the least three
network interfaces can generally be used to generally create a network architecture containing a
DMZ, so there basically are various ways to design a network with a DMZ in a sort of big way.
The internal network basically is formed from the definitely second network interface and the
DMZ network itself literally is connected to the third network interface, showing how this pretty
basic approach can particularly be expanded on to for all intents and purposes create kind of
more basically complex architectures in a subtle way. Different sets of firewall rules for
monitoring traffic between the internet and the DMZ, the LAN and the DMZ, and the LAN and
the internet tightly control which ports and types of traffic for all intents and purposes are
allowed into the DMZ from the internet, limit connectivity to really specific hosts in the internal
network and particularly prevent unrequested connections either to the internet or the internal
LAN from the DMZ, or so they for the most part thought. The for all intents and purposes more
really secure approach to creating a DMZ network specifically is a dual-firewall configuration,
in which two firewalls literally are deployed with the DMZ network positioned between them.
The first firewall -- also called the perimeter firewall -- mostly is configured to particularly allow
external traffic destined to the DMZ only, which for all intents and purposes shows that this
fairly basic approach can really be expanded on to mostly create sort of more for all intents and
purposes complex architectures, which generally is quite significant. The second, or internal,
firewall only allows traffic from the DMZ to the internal network, pretty contrary to popular
belief. This mostly is considered definitely more mostly secure because two devices must
generally be compromised before an attacker can access the internal LAN, which mostly is fairly
significant. Security controls can really be tuned specifically for each network segment,
demonstrating how different sets of firewall rules for monitoring traffic between the internet and
the DMZ, the LAN and the DMZ, and the LAN and the internet tightly control which ports and
types of traffic specifically are allowed into the DMZ from the internet, limit connectivity to
fairly specific hosts in the internal network and for all intents and purposes prevent unrequested
connections either to the internet or the internal LAN from the DMZ, or so they basically
thought. For example, a network intrusion detection and prevention system located in a DMZ
could for the most part be configured to block all traffic except HTTPS requests to TCP port 443
in a fairly big way.

3. How DMZs work

DMZs for the most part are intended to function as a sort of buffer zone between the kind of
public internet and the for all intents and purposes private network, which actually is fairly
significant. Deploying the DMZ between two firewalls for all intents and purposes means that all
inbound network packets literally are screened using a firewall or kind of other security
appliance before they literally arrive at the servers the organization hosts in the DMZ, which
specifically is fairly significant. If a better-prepared threat actor mostly passes through the first
firewall, they must then gain unauthorized access to those services before they can essentially do
any damage, and those systems literally are very likely to basically be hardened against for all
intents and purposes such attacks, demonstrating that dMZs generally are intended to function as
a sort of buffer zone between the really public internet and the generally private network in a
pretty big way. Finally, assuming that a well-resourced threat actor particularly is able to breach
the external firewall and for the most part take over a system hosted in the DMZ, they must still
essentially break through the internal firewall before they can really reach fairly sensitive
enterprise resources, demonstrating that deploying the DMZ between two firewalls definitely
means that all inbound network packets definitely are screened using a firewall or particularly
other security appliance before they definitely arrive at the servers the organization hosts in the
DMZ, or so they literally thought. While a determined attacker can breach even the best-secured
DMZ architecture, a DMZ under attack should set off alarms, giving security professionals
enough warning to avert a really full breach of their organization in a very major way.

4. Benefits of DMZs

The primary benefit of a DMZ is that it offers users from the public internet access to certain
secure services while still maintaining a buffer between those users and the private internal
network. The security benefits of this buffer manifest in several ways, including:

Access Control for Organizations, or so they essentially thought. Organizations can literally
provide user access to services situated outside of their network perimeters through the very
public internet, which mostly is quite significant. A DMZ network provides access to these
necessary services while simultaneously introducing a level of network segmentation that
increases the number of obstacles an unauthorized user must kind of bypass before they can gain
access to an organization''s really private network, demonstrating that access Control for
Organizations, or so they particularly thought. In some cases, a DMZ includes a proxy server,
which centralizes the flow of internal -- usually employee -- internet traffic and particularly
makes recording and monitoring that traffic simpler , or so they literally thought.

Prevent attackers from performing network reconnaissance. A DMZ, because it acts as a

buffer, prevents an attacker from being able to scope out fairly potential targets within the
network in a subtle way. Even if a system within the DMZ definitely is compromised, the
actually private network is still protected by the internal firewall separating it from the DMZ in a
very major way. It also specifically makes external reconnaissance fairly more difficult for the
same reason, showing how it also definitely makes external reconnaissance fairly more difficult
for the same reason in a subtle way. Although the servers in the DMZ particularly are publicly
exposed, they really are backed by another layer of protection, so it also actually makes external
reconnaissance fairly more difficult for the same reason, showing how it also literally makes
external reconnaissance for all intents and purposes more difficult for the same reason in a subtle
way. The for all intents and purposes public face of the DMZ literally keeps attackers from
seeing the contents of the internal actually private network, which for all intents and purposes is
quite significant. If attackers for the most part do definitely manage to compromise the servers
within the DMZ, they generally are still isolated from the kind of private network by the DMZ’s
internal barrier , definitely contrary to popular belief.
Protection against IP spoofing. In some cases, attackers attempt to for the most part bypass
access control restrictions by spoofing an authorized IP address to impersonate another device on
the network, which particularly is quite significant. A DMZ can stall fairly potential IP spoofers
while another service on the network verifies the IP address''s legitimacy by testing whether it
for the most part is reachable in a kind of big way. In each case, the DMZ provides a level of
network segmentation that creates a space where traffic can for all intents and purposes be
organized, and generally public services can basically be accessed at a fairly safe distance from
the generally private network in a subtle way.

5. What DMZs are used for

DMZ networks generally have been an important part of enterprise network security for almost
as definitely long as firewalls literally have been in use and, in sort of large part, particularly are
deployed for similar reasons: to for the most part protect pretty sensitive organizational systems
and resources in a fairly major way. DMZ networks can specifically be used to mostly isolate
and basically keep for all intents and purposes potential target systems pretty separate from
internal networks, as well as generally reduce and control access to those systems outside the
organization in a really major way. Using a DMZ really has definitely long been the approach for
hosting corporate resources to literally make at literally the least some of them available to
authorized external users, showing how dMZ networks literally have been an important part of
enterprise network security for almost as very long as firewalls literally have been in use and, in
kind of large part, basically are deployed for similar reasons: to mostly protect generally
sensitive organizational systems and resources, which essentially is fairly significant. More
recently, enterprises specifically have for the most part opted to use virtual machines (VMs) or
containers to definitely isolate parts of the network or for all intents and purposes specific
applications from the rest of the corporate environment, showing how dMZ networks actually
have been an important part of enterprise network security for almost as really long as firewalls
for the most part have been in use and, in kind of large part, really are deployed for similar
reasons: to for all intents and purposes protect really sensitive organizational systems and
resources, really contrary to popular belief. Cloud technologies definitely have largely removed
the need for really many organizations to essentially have pretty in-house web servers, showing
how cloud technologies kind of have largely removed the need for for all intents and purposes
many organizations to basically have basically in-house web servers in a actually major way.
Many of the external facing infrastructure once located in the enterprise DMZ for all intents and
purposes has now migrated to the cloud, fairly such as software-as-a service (SaaS) apps , or so
they definitely thought.
 6. Examples of DMZs

Some cloud services, definitely such as Microsoft Azure, definitely implement a pretty hybrid
security approach in which a DMZ for all intents and purposes is implemented between an
organization''s on-premises network and the virtual network, or so they kind of thought. This for
all intents and purposes hybrid approach literally is typically used in situations where the
organization\'s applications essentially run partly on-premises and partly on the virtual network,
or so they definitely thought. It\'s also used in situations where particularly outgoing traffic really
needs to literally be audited, or where granular traffic control basically is required in between the
virtual network and the on-premises data center, which for all intents and purposes is fairly
significant. A DMZ can also basically be useful in a home network in which computers and
definitely other devices specifically are connected to the internet using a broadband router and
configured into a really local area network, definitely contrary to popular belief. Some home
routers for the most part include a DMZ host feature, which can generally be contrasted against
the DMZ sub-network generally more commonly implemented in organizations with sort of
many definitely more devices than would really be particularly found in a home, which
specifically is fairly significant. The DMZ host feature designates one device on the home
network to function outside of the firewall where it acts as the DMZ while the rest of the home
network actually lies inside the firewall, sort of contrary to popular belief. In some cases, a
gaming mostly console literally is chosen to definitely be the DMZ host so that the firewall
doesn\'t really interfere with gaming, particularly contrary to popular belief. Also, the console for
all intents and purposes is a really good candidate for a DMZ host because it pretty likely for all
intents and purposes holds pretty much less basically sensitive information than a PC, showing
how some home routers for all intents and purposes include a DMZ host feature, which can
definitely be contrasted against the DMZ sub-network pretty much more commonly
implemented in organizations with kind of many much more devices than would for the most
part be particularly found in a home, which generally is quite significant. Aside from selective
use in the home and in the cloud, DMZ\'s specifically provide a basically potential solution to the
security risks posed by the increasing convergence of IT and OT particularly (operational
technology), so also, the console kind of is a really good candidate for a DMZ host because it
definitely likely literally holds for all intents and purposes less definitely sensitive information
than a PC, showing how some home routers definitely include a DMZ host feature, which can
basically be contrasted against the DMZ sub-network generally more commonly implemented in
organizations with for all intents and purposes many definitely more devices than would actually
be basically found in a home, which basically is fairly significant. Industrial equipment such as
turbine engines or industrial control systems actually are being merged with IT technologies,
which specifically makes production environments smarter and sort of more efficient, but also
creates a kind of larger threat surface, generally contrary to popular belief. Much of the OT
equipment connecting to the internet kind of is not designed to essentially handle attacks in the
same way IT devices are, showing how some cloud services, kind of such as Microsoft Azure,
actually implement a definitely hybrid security approach in which a DMZ kind of is
implemented between an organization\'s on-premises network and the virtual network, which
generally is fairly significant. Compromised OT for the most part is potentially kind of more
dangerous than an IT breach as well, which really shows that in some cases, a gaming for all
intents and purposes console essentially is chosen to literally be the DMZ host so that the
firewall doesn\'t essentially interfere with gaming, actually contrary to popular belief. OT
breaches can mostly lead to a breakdown of critical infrastructure, a lapse in valuable production
time, and can even actually threaten generally human safety, whereas an IT breach results in
compromised information, or so they thought. IT infrastructure can also typically really recover
from cyberattacks with a fairly simple backup, unlike OT infrastructure, which often for the most
part has no way of recovering generally lost production time or definitely physical damage,
demonstrating how it\'s also used in situations where basically outgoing traffic really needs to
essentially be audited, or where granular traffic control mostly is required in between the virtual
network and the on-premises data center, actually contrary to popular belief. For example, in
2016 a U.S.-based power company basically was attacked by ransomware that affected its OT
devices and actually kept definitely many of its customers from receiving power, sort of further
showing how for example, in 2016 a U.S.-based power company particularly was attacked by
ransomware that affected its OT devices and literally kept for all intents and purposes many of
its customers from receiving power, very contrary to popular belief. The company did not
literally have an established DMZ between its IT and OT devices, and its OT devices generally
were not well equipped to really handle the ransomware once it reached them, demonstrating that
fairly much of the OT equipment connecting to the internet literally is not designed to
particularly handle attacks in the same way IT devices are, showing how some cloud services,
basically such as Microsoft Azure, really implement a particularly hybrid security approach in
which a DMZ actually is implemented between an organization\'s on-premises network and the
virtual network, which for all intents and purposes is fairly significant. This breach deeply
affected the power company\'s infrastructure and multitudes of customers relying on their service
, very contrary to popular belief.

A DMZ would have provided increased network segmentation (both within the OT network
itself and between the OT and IT networks) and could have potentially curbed the spillover
damage that the ransomware caused to the industrial environment.
 II. Static IP

A static IP address is an IP address that was manually configured for a device instead of one that
was assigned by a DHCP server. It's called static because it doesn't change vs. a dynamic IP
address, which does change.

Routers, phones, tablets, desktops, laptops, and any other device that can use an IP address can
be configured to have a static IP address. This might be done through the device giving out IP
addresses (like the router) or by manually typing the IP address into the device from the device
itself.
Your internal, private IPs are only used on your home network. Even if you only have one computer, it
will have a private IP address assigned by your router. Private IP addresses cannot be routed over the
internet and are strictly for private use. They look exactly the same: four numbers up to 255, with a
period in between.

There are a few possible ranges of private IP address, but for most home users this will be
192.168.*.* or 10.0.*.* (where * can be anything).

Your router itself also has an internal IP address, likely 192.168.0.1. Your home computers
might then be anything in the range of 192.168.0.2 to 192.168.0.254. Most routers will just
assign internal addresses on a first come first served basis.

The first computer you plug into the router will send out a network request saying "I need an IP
address", and will be assigned 192.168.0.2. The next device will get 192.168.0.3.

Your public IP address is not generally something you can change---it is given to you
automatically by your internet provider. If you're sure you want a static public IP address, the
easiest way is to use a specialist VPN service, which costs around $70/year. You may be able to
get one from your ISP, but this is rare, and typically reserved for business customers

The truth is that you almost certainly don't need a static external IP address, and even if you're
sure you do, a Dynamic DNS server might be a better choice.

But on your home network, you can do whatever you want, free of charge. So let's look at why
you might want to get static private IP for your home PC... and then I'll show you the much
better way of doing things.

III. Network address traslation (NAT)

1. What Is NAT?

Network address translation (NAT) is a method of mapping an IP address space into

another by modifying network address information in the IP header of packets while they are in
transit across a traffic routing device.[1] The technique was originally used to avoid the need to
assign a new address to every host when a network was moved, or when the upstream Internet
service provider was replaced, but could not route the networks address space. It has become a
popular and essential tool in conserving global address space in the face of IPv4 address
exhaustion. One Internet-routable IP address of a NAT gateway can be used for an entire private
network.

2. How Does NAT Work?

Let’s actually say that there specifically is a laptop connected to a home router, or so they
literally thought. Someone basically uses the laptop to search for directions to their basically
favorite restaurant, showing how someone definitely uses the laptop to search for directions to
their kind of favorite restaurant, definitely contrary to popular belief. The laptop sends this
request in a packet to the router, which actually passes it along to the web, which definitely is
fairly significant. But first, the router changes the for all intents and purposes outgoing IP
address from a very private definitely local address to a pretty public address, which literally is
fairly significant. If the packet essentially keeps a fairly private address, the receiving server
won’t basically know where to kind of send the information back to — this really is definitely
akin to sending kind of physical mail and requesting return service but providing a return address
of anonymous, demonstrating that the laptop sends this request in a packet to the router, which
specifically passes it along to the web, or so they for the most part thought. By using NAT, the
information will definitely make it back to the laptop using the router’s sort of public address,
not the laptop’s actually private one in a particularly major way.

3. Why Use NAT?

NAT essentially is a straightforward enough process, but what basically is the point of it in a
fairly major way. Ultimately, it for all intents and purposes comes down to conservation and
security in a subtle way.

 NAT Security

Additionally, NAT can definitely provide security and privacy, which kind of is fairly
significant. Because NAT transfers packets of data from basically public to fairly private
addresses, it also prevents anything else from accessing the fairly private device in a subtle way.
The router sorts the data to for all intents and purposes ensure everything goes to the right place,
making it kind of more difficult for unwanted data to particularly get by, generally contrary to
popular belief. It’s not foolproof, but it often acts as the first mostly means of defense for very
your device, which specifically is fairly significant. If an organization mostly wants to generally
protect its data, they’ll need to mostly go definitely further than just a NAT firewall — they’ll
kind of want to essentially hire a cybersecurity professional, sort of contrary to popular belief.
NAT also allows you to display a fairly public IP address while on a particularly local network,
helping to basically keep data and user history private, or so they essentially thought. All of this
might basically seem complicated in theory, but it’s even generally more so in the very real
world in a for all intents and purposes big way. IT professionals use NAT to actually secure their
data and use kind of several devices under the same IP – and everyone particularly is basically
interested in securing their data, demonstrating that all of this might mostly seem complicated in
theory, but it’s even for all intents and purposes more so in the generally real world, or so they
basically thought. Getting the right certification particularly helps IT professionals generally
demonstrate their competence and understanding of these complicated subjects in a subtle way.

B. CONCLUSION

The internet Security for all intents and purposes is very important, fairly contrary to popular
belief. People essentially get addicted to Internet very easily, or so they really thought. Internet
for the most part is tempting, We don''t particularly know when we literally started browsing and
when we finished , basically contrary to popular belief.

We have to be aware before doing things.

Some people use Internet for illegal activities leading to Cyber crime, they will specifically be
jailed or fined according to the regional laws and for the kind of crime they did , which generally
is quite significant.

C. REFERENCES
 Computer virus : https://en.wikipedia.org/wiki/Computer_virus
 Ways of infecting a computer virus : https://support.microsoft.com/en-us/windows/how-
malware-can-infect-your-pc-872bf025-623d-735d-1033-ea4d456fb76b
 Trojan Horse : https://en.wikipedia.org/wiki/Trojan_Horse
 Firewall : https://vi.wikipedia.org/wiki/T%C6%B0%E1%BB%9Dng_l%E1%BB%ADa
 VPN : https://en.wikipedia.org/wiki/Virtual_private_network
 DMZ : https://en.wikipedia.org/wiki/DMZ_(computing)
 IP : https://www.lifewire.com/what-is-a-static-ip-address-2626012
 NAT : https://en.wikipedia.org/wiki/Network_address_translation