Data Security: Home User Threats, Yahoo Case Study, Prevention

This report examines the critical issue of data security for home users, highlighting the increasing vulnerabilities in the digital landscape. It begins by emphasizing the growing reliance on the internet and the corresponding rise in cyber threats, with a specific focus on the case of Yahoo and its significant data breaches. The report delves into various threats, including keyloggers, denial-of-service (DoS) attacks, and phishing, explaining how these threats compromise user data and system integrity. It analyzes the factors that make home users particularly susceptible, such as a lack of awareness and preparation. Furthermore, the report explores several prevention strategies. These include recommending proactive measures such as using firewalls, password managers, and anti-phishing software, alongside the importance of staying informed about security best practices. The report concludes with the importance of vigilant account monitoring, safe handling of emails, and the practice of limiting the use of personal devices to secure user data and digital footprint.

Running head: HOME USERS AND DATA SECURITY
Home Users and Data Security
Name of the student:
Name of the university:
Author Note

1HOME USERS AND DATA SECURITY
Discussion on threats faced by Internet users and the case of Yahoo:
The dependence of human beings on Internet and usage of Internet has brought dangerous
and new risks. It is because of rise in attempts from the third parties who are unauthorized. This to
make compromise with the private data from their individual advantages from the overall sector of
cyber-crime. Thus, it is important that every user can evaluate risks of utilizing the online. Here, the
significance to secure the personal data and results as that is never done properly. Particularly, the
home users are vulnerable to this and cyber criminals have those users squarely under target.
Further, the vulnerability of the home users are because of various factors and the most vital one is
the fact that those home users at many cases are never aware of risks to use Internet. They frequently
access the cyber world despite any sort of preparation or awareness for the journey. The following
study makes a discussion on various threats regarding the case of Yahoo. Besides, the additional
treats witnessed by the users are also investigated here. Lastly, different prevention mechanisms of
those threats are also analyzed.
Different threats for the given case of Yahoo:
Yahoo is a popular Internet portal. They includes search engine along with the directory of
World Wide Web websites that are arranged in hierarchical manner of various categories of topic.
They being a directory has provided the seasoned and new users of Web with the reassurance of
structured point of view of numerous sites and webpages. Yahoo has been seen to be warning their
various users that their respective accounts having the service of Yahoo might get compromised
under huge data breach. There is a warning present in the email messages that are sent from the side
of Yahoo CISO Bob Lord, state the users that they forged cookie might be utilized for accessing the
accounts. There has a data breach that is related to more than one billion accounts of users during

2HOME USERS AND DATA SECURITY
2013. Earlier, they have reported a distinct database that has been putting impact on more than five
million users that happened during 2014. Further, from a new warning that was sent again, the
business reported that the issue of forged cookie permitted hackers to achieve the access to the
accounts of the users without any password. This problem was related to the breach. On the basis of
investigation, they believed that the forge cookie has been utilized during 2015 or 2016 for accessing
the accounts. Again, they have linked few cookie forging the tasks to similar state-sponsored actor
who are seen to be liable for the theft of data that was disclosed during 2016. Moreover, the
organization has been unable to determine the actor that was state sponsored. Here, a new email has
been sent to users who had the accounts breached that as apparently a common attack. Here, the
individual users has seemed to be targeted specially from the side of the actor that was state-
sponsored sending extra notice.
Different other threats that are faced by users of Internet:
Keylogger:
The keylogger is also known as the system monitor or keystroke logger. It is a kind of
surveillance technology that utilized for monitoring and recording every keystroke hat is typed on
particular keyboard. It is able to record the instant messages, mails and can capture the data that one
type at any point of time through the keyboard. This includes the passwords, usernames and
additional personally identifiable data (Haque, 2019). Apart from that, unlike other kinds of
malicious programs, there pose no such threat to the system. However, they can present serious
threat to the users since they are able to use the interception of passwords and additional confidential
data that is been entered through keyboard. Due to that, the cyber criminals are able to get PIN codes
and different account numbers that are related t e-payment systems and password for the email
addresses, email passwords, online gaming accounts, user-names and so on (Shillair & Dutton,

3HOME USERS AND DATA SECURITY
2016). As the cyber criminals get hold of the confidential user information, they can simply make
transfer of the money from account of user and access online gaming account of users. It is
unfortunate that access to the confidential information at many times have results that are more
serious that any loss of money for individuals. It can be utilized for the tools at the political and
industrial espionage and accessing the information might involve the proprietary commercial data
and the classified government resources that is able to make compromise with security of the state-
owned and commercial companies like through stealing of private encryption keys. Moreover, it is
one of the popular processes that is used for cyber fraud. Here, the users aware of those security
concerns can simply secure themselves against the phishing through neglecting phishing emails and
never entering the personal data over suspicious sites (Van Schaik et al., 2017). However, it is also
complicated to users in combatting with keyloggers. Here, is the just the possible manner for using
suitable security solution. This is because it is commonly impossible for users to reveal that
keylogger is installed on the machine.
Denial-of-Service Attack or DOS:
It is the attack intended for closing down network or network. Thus it could be unreachable
to the prospected users. This attack gain the plan through deluging the target with the traffic and then
sending data that give rise to the crash. It denies various authentic users of the asset or service they
have anticipated. Many methods are there for conducting DoS attack (Spinello, 2019). Here the most
common one is that the attack happens as the attacker is seen to flood the network server with the
traffic. One of the common process of attack happens as the attackers floods network server with
that traffic. Here, the attacker can send various requests to targeted server (Anwar et al., 2017).
Besides, it gets overloading with the traffic. Those requests of the services are illegitimate and
possess fabricated type of return address misleading the server as it attempts to authenticate
requester. Since, e junk requests are been constantly processed that server get overwhelmed resulting

4HOME USERS AND DATA SECURITY
DoS condition for legitimate the requestor. Under smurf attack, it is seen that the attacker has been
sending the broadcast packages of Internet Control Message Protocol. This is towards various hosts
having spoofed source IP or Internet Protocol addressing that can belong to the machine targeted.
These recipients of the spoofed packages would never react and the targeted host would be flooded
through the reactions (Siami Namin et al., 2018). Apart from that the SYN flood has been happening
as the attacker sends requests for connecting targets server and never finish the link with what is
called as the three-way handshake. This is a type of TCP/IP Transmission Control Protocol for
generating the link between server and client/host. This unfinished handshake has left the connected
ports under the occupied status and has been unavailable for future requests. For this, the attackers
can make the constant effort to send different requests along with saturating every open ports
(Ramírez, 2017). Hence, the legitimate users are unable to connect. Again, individual networks
could be influenced through DoS attacks despite getting targeted directly. As the ISP or Internet
Service Provides or the provider of cloud service is targeted and then attacked, the network can face
a service loss.
Phishing:
This is process of social engineering having the aim to retrieve sensitive data like credit card
numbers, usernames and passwords. It commonly originate as instant messages and phishing mails
that are been appearing to be legitimate. This email recipient can be tricked to open malicious links
leading to malware installation on the computer of recipient (Chang, 2017). Furthermore, personal
data can also be obtained through sending mails appearing to be sent from the bank and requesting
the verification of the user’s identity through providing private information.

5HOME USERS AND DATA SECURITY
Understanding the preventive measures:
For the case of Yahoo, it is recommended from their end that the users must b reviewing their
accounts regarding any sort of suspicious activity. They should be cautious of various type of
unsolicitated communications asking for personal data and then avoid clicking on the attachments of
downloading or links adopting the Yahoo Account Key. This authentication tool is able to eradicate
the necessities of password. Moreover, they are found to invalidate their forged cookies and has been
hardening the systems for securing them against same type of attacks. They have been constantly
developing the systems and safeguards. This is useful to find and check the unauthorized access
towards the accounts of various users.
To prevent the keylogger a firewall can be used. As the internet passes across the firewall
there are scopes that it can understand anything that is just right. Next, a password manager can be
installed. The passwords can be updated or changed (Namin et al., 2018). Apart from that the
systems must be updated. For this the one must be aware about the security of the system. For
proactive defense the system must be kept updated. Apart from that additional security tools can be
considered. Lastly, the passwords must be changed. As one suspect anything to be wrong, distinct
computer can be used for changing the passwords (Van Horenbeeck, 2018). Again, the DoS can be
prevented through the following ways. Firstly, there should be cloud mitigation provider. They are
the experts to deliver the mitigation of DDoS from cloud. T indicates that one should create huge
quantity of network bandwidth and the capacity of DDoS mitigation at numerous sites across the
Internet taking any kind of network traffic. This is irrespective of one utilize the numerous ISP, the
individual data center and the cloud providers. Besides, they can scrub traffic for one and just send
the clean traffic to the data center (Buse, 2017). Further, there is the firewall. It is the least and
simplest efficient process. Lastly, there is the ISP or Internet Service Provider. Besides, there are few
enterprises using ISP for providing the mitigation of DDoS. These ISP’s consist of much more

6HOME USERS AND DATA SECURITY
bandwidth than any enterprise helpful with huge attacks that are volumetric in nature. To prevent
phishing one should be understanding enough to determine any suspected phishing emails. Further,
the source of data must be checked from the incoming mail (Siami Namin et al., 2016). Besides,
users must develop their computer’s security and enter the sensitive information to secure the sites.
Moreover, the accounts must be checked periodically. Here, an anti-phishing software can be
implemented. Various options are there in the market offering distinct set of capabilities like
handling zero-day vulnerabilities, neutralizing and identifying malware attachments, finding man-in-
handle attacks, neutralizing and deterring malware attachments. This is specialized to control the
loud based communication of mails versus the one that could get installed with the servers of on-
premise mail operating beyond the firewalls (Blackwood-Brown, Levy & D’Arcy, 2019). Lastly, the
mails must be handled safely that have the ability to reach the users.
Thus it can be said by concluding the clicking without thinking that to be reckless. Next, one
should get stuck to the individual devices. For this one should try to limit the usage of the device of
the users whenever possible. Apart from that one should never share the credentials with the others
and must be never providing any person with distant access to the computer. Here, one should be
aware of the surroundings and for that eyes must be kept on the devices. This must be locked a step
away from the system and never any sensitive data must be left or any kind of confidential items at
the desk. Moreover, a track of the digital footprint must be kept. As one monitor the accounts, one
should assure to catch any sort of suspicious activity. Further, the updates must be kept and the
software patches must be issued as the flaws in security are seen. Apart from that connection must be
securely, and the mobile device are to be secured. One should also be aware of social engineering.

7HOME USERS AND DATA SECURITY
References:
Anwar, M., He, W., Ash, I., Yuan, X., Li, L., & Xu, L. (2017). Gender difference and employees'
cybersecurity behaviors. Computers in Human Behavior, 69, 437-443.
Blackwood-Brown, C., Levy, Y., & D’Arcy, J. (2019). Cybersecurity Awareness and Skills of
Senior Citizens: A Motivation Perspective. Journal of Computer Information Systems, 1-12.
Buse, M. (2017). European Union cyber security in a globalized world. In International Scientific
Conference" Strategies XXI" (Vol. 1, p. 159). " Carol I" National Defence University.
Chang, L. Y. (2017). Cybercrime and Cyber security in ASEAN. In Comparative Criminology in
Asia (pp. 135-148). Springer, Cham.
Haque, A. K. M. (2019). Need for Critical Cyber Defence, Security Strategy and Privacy Policy in
Bangladesh–Hype or Reality?. International Journal of Managing Information Technology
(IJMIT) Vol, 11.
Lesjak, D., Zwilling, M., & Klein, G. (2019). CYBER CRIME AND CYBER SECURITY
AWARENESS AMONG STUDENTS: A COMPARATIVE STUDY IN ISRAEL AND
SLOVENIA. Issues in Information Systems, 20(1).
Namin, A. S., Hewett, R., Jones, K. S., & Pogrund, R. (2018). The Sounds of Cyber Threats. arXiv
preprint arXiv:1805.08272.
Ramírez, J. M. (2017). Some criminal aspects of cybersecurity. In Cyberspace (pp. 141-151).
Springer, Cham.

8HOME USERS AND DATA SECURITY
Shillair, R., & Dutton, W. H. (2016). Supporting a cybersecurity mindset: getting internet users into
the cat and mouse game. Available at SSRN 2756736.
Siami Namin, A., Hewett, R., Jones, K. S., & Pogrund, R. (2016, May). Sonifying internet security
threats. In Proceedings of the 2016 CHI Conference Extended Abstracts on Human Factors
in Computing Systems (pp. 2306-2313).
Siami Namin, A., Hewett, R., Jones, K. S., & Pogrund, R. (2018). The Sounds of Cyber Threats.
arXiv preprint arXiv:1805.08272.
Spinello, R. A. (2019). Ethics in Cyberspace: Freedom, Rights, and Cybersecurity. Next-Generation
Ethics: Engineering a Better Society, 444.
Van Horenbeeck, M. (2018). The future of Internet governance and cyber-security. Computer Fraud
& Security, 2018(5), 6-8.
Van Schaik, P., Jeske, D., Onibokun, J., Coventry, L., Jansen, J., & Kusev, P. (2017). Risk
perceptions of cyber-security and precautionary behaviour. Computers in Human Behavior,
75, 547-559.
Zhan, X., Nah, F. F. H., & Cheng, M. X. (2018, July). An assessment of users’ cyber security risk
tolerance in reward-based exchange. In International Conference on HCI in Business,
Government, and Organizations (pp. 431-441). Springer, Cham.
Zwilling, M., Klien, G., Lesjak, D., Wiechetek, Ł., Cetin, F., & Basim, H. N. (2020). Cyber Security
Awareness, Knowledge and Behavior: A Comparative Study. Journal of Computer
Information Systems, 1-16.

9HOME USERS AND DATA SECURITY